Re: Best practices for very high volume install..

[Joel Esler <jesler () sourcefire com>]

Using unified2 and barnyard2 removes the output logging slowdown from Snort. It can go very very fast.  

Most of the speed can be found in reducing ruleset and tuning. 


Sent from my iPhone

On Dec 20, 2010, at 6:27 PM, "Castle, Shane" <scastle () bouldercounty org> wrote:

> Using Barnyard? The claim is that with Barnyard2 a 10G link can be
> supported.
>
> -- 
> Shane Castle
> Data Security Mgr, Boulder County IT
> CISSP GSEC GCIH
>
> -----Original Message-----
> From: Wil Schultz [mailto:wschultz () bsdboy com] 
> Sent: Monday, December 20, 2010 14:25
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Best practices for very high volume install..
>
> Hey there, have a very high traffic install (snort 2.9/barnyard2) that
> I'm trying to get into a good and usable position. 
>
> At this point I've got a gig port that's saturated to the box so we're
> going to do a 2g port-channel here in a bit.
>
> So far I've come to the conclusion that mysql binary logging isn't
> realistic, so it's been turned off.
>
> Additionally I've got a script that runs at midnight to purge alerts
> that are greater than 2 days old.
>
> I'm considering putting the database into RAM for a little more speed.
>
> Does anyone else have some other best practice type suggestions for a
> very high traffic box?
>
> -wil
> ------------------------------------------------------------------------
> ------
> Lotusphere 2011
> Register now for Lotusphere 2011 and learn how
> to connect the dots, take your collaborative environment
> to the next level, and enter the era of Social Business.
> http://p.sf.net/sfu/lotusphere-d2d
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> ------------------------------------------------------------------------------
> Lotusphere 2011
> Register now for Lotusphere 2011 and learn how
> to connect the dots, take your collaborative environment
> to the next level, and enter the era of Social Business.
> http://p.sf.net/sfu/lotusphere-d2d
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Lotusphere 2011
Register now for Lotusphere 2011 and learn how
to connect the dots, take your collaborative environment
to the next level, and enter the era of Social Business.
http://p.sf.net/sfu/lotusphere-d2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users