Snort mailing list archives
Re: barnyard to db
From: Chris Green <cmg () uab edu>
Date: Thu, 04 Oct 2001 11:12:21 -0500
"Frank Reid" <fcreid () ourcorner org> writes:
I'm confused on barnyard. From mailing list discussion and docs, I presume it rolls up the Snort binary output and performs the database insertions directly (rather than having Snort insert "real-time" into the database via the output preprocessor).
Right. It means the postprocessing of the alert is separated from the alert itself.
Is that's correct, then is it of most value if Snort and the database live on the same box?
No.
In a distributed Snort sensor environment, one would have to "collect" the Snort output by some other means, then have barnyard read it into the database?
Right or write a barnyard plugin that sends the files over the network. Think of snort + barnyard as "portable threads". Snort does the logging. Barnyard sends the alerts that once can then process in whatever way they please while handling bursty traffic. -- Chris Green <cmg () uab edu> You now have 14 minutes to reach minimum safe distance. _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- barnyard to db Mike Poor (Oct 01)
- Re: barnyard to db Andrew R. Baker (Oct 01)
- Re: barnyard to db Jed Pickel (Oct 03)
- Re: barnyard to db Dragos Ruiu (Oct 04)
- RE: barnyard to db Jeff Dell (Oct 04)
- Compile problem Kevin Pietersma (Oct 04)
- Re: barnyard to db Martin Roesch (Oct 04)
- RE: barnyard to db Frank Reid (Oct 04)
- RE: barnyard to db Erek Adams (Oct 04)
- RE: barnyard to db Andrew R. Baker (Oct 04)
- Re: barnyard to db Chris Green (Oct 04)
- Re: barnyard to db Jed Pickel (Oct 03)
- Re: barnyard to db Andrew R. Baker (Oct 01)
- Re: barnyard to db Andrew R. Baker (Oct 04)