Snort mailing list archives
Re: portscan questions...
From: roman () danyliw com
Date: Fri, 7 Sep 2001 14:45:05 US/Eastern
Shawn,
I was trying to look at the portscan log using acid and I get an error: "Maximum execution time of 30 seconds exceeded in /home/httpd/html/acid/acid_stat_ipaddr.php on line 118" is there anyway to extend this time? I tried altering the "max_execution_time" variable in acid_conf.php but that only modifies executions going to the database. (it's set to 580 now)
I assume you mean you modified the $max_script_runtime variable. Well, it looks like the value of max_script_runtime is not being propogated everywhere that it should in ACID (read: a bug). A work-aournd for this issue is to modifying the max_execution_time in config file (php.ini) of the PHP engine. A patch has also been committed to CVS to correctly set the max_execution_time based on the setting of max_script_runtime in acid_conf.php. This patch will obviate the need to modify the global PHP configuration.
Also, is there anyway to store the portscan information into the mysql database instead of a file?
No. The schema does not yet support this. cheers, Roman --------------------------------------------- This message was sent using Voicenet WebMail. http://www.voicenet.com/webmail/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- portscan questions... Grimes, Shawn (NIA/IRP) (Sep 07)
- Snort and Snarf - Way Cool Bob (Sep 12)
- <Possible follow-ups>
- Re: portscan questions... roman (Sep 07)