Honeypots mailing list archives
Re: Problem with Honeywall and MySQL
From: "Earl" <esammons () hush com>
Date: Fri, 08 Dec 2006 13:20:44 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mark, The minimums are essentially what we believe it takes to get you up and running with a very basic setup. If you think about it, due to the nature of this particular application / activity its really tough (although not impossible) to come up with metrics to be able to say "To run like this, you need this much hardware" with any degreee of reliability. There are so many variables. Although I believe it has been stated that there are data management/purge problems in the currently public 1.0 branch I can't put my finger on any of them at the moment. We spent quite a bit of time making it work right for the 1.1 branch which we are trying desperately to get out (stay tuned) so I hope the new release will at least help you to be able to reliably trim data. Sorry for the slow response... Earl On Mon, 04 Dec 2006 16:03:02 -0500 "Mark J. Hufe" <mark.j.hufe () wilmcoll edu> wrote:
Concerning the database, I'm wondering if this new release might provide some relief. I have a single honeypot running Linux SUSE 10.0 and the database on the honeywall becomes unmanageable within a week or two. By unmanageable, I mean that queries from Walleye take so long that they are no longer feasible. In particular, I've been trying to track SSH attacks via Sebek queries and process tree expansion. I'm either doing something wrong or the recommended minimum hardware configuration in the online users manual is maybe a little understated. The honeywall is running on a Pentium 4 desktop at 3.4 GHz with 1 GB of memory. The online manual lists 256 MB RAM as the minimum with 512 MB recommended and a minimum Pentium 3 processor. I forget who advised it, but I've been re-installing as a means of clearing out the database. Doing so only takes about 5 minutes. If I recall correctly, the minimum size of the database was set to either 30 or 45 days. Something like a week or two might be helpful for a system like mine. I've got an order in to upgrade the server to something more substantial, but the wheels of purchasing turn oh so slowly. Is it likely that the Roo upgrade will help? - Mark Lance Spitzner wrote:Sam, we are working hard to get the new Honeywall CDROM 1.1 outthewindow. Poor Earl is pulling his hair out to squash the finalbugs(not a pretty site :). We had hoped to have it out already butraninto last minute issues and are adding one more feature. Thenewrelease should resolve issues like these and many others. Ifyou canwait a week or two more, you should have the latest and greatestbythen. Also, the publicly SVN server is still under the works. Our SVNgurugot crushed during the Thanksgiving holidays, thus the delay. Appreciate everyone's patience! :) lance
-----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkV5xwAACgkQk7+e+4lPSm1pgQCgqagrMPKvyaf47hYial7iMwHL/KoA mQGb/WEvWK9d3XP75BGfKu90VYDX =1Lj+ -----END PGP SIGNATURE-----
Current thread:
- Problem with Honeywall and MySQL mng3 () libero it (Dec 04)
- RE: Problem with Honeywall and MySQL ROPERT François (Dec 04)
- Re: Problem with Honeywall and MySQL Lance Spitzner (Dec 04)
- Re: Problem with Honeywall and MySQL Mark J. Hufe (Dec 05)
- <Possible follow-ups>
- Re: Problem with Honeywall and MySQL Earl (Dec 08)