Re: Run an external program

[Bennett Todd <bet () rahul net>]

2003-03-05T09:39:50 Erek Adams:
> I'd honestly suggest moving to a *NIX platform and alerting to
> a socket.

That would worry me; wouldn't snort block on writes when the reader
is off executing some program?

Rather than using IPC to let swatch feed the program-executer
directly, go by way of a logfile; if the program-executer doesn't
always keep up (if it falls behind when it's running the external
program) that's fine, the logfile provides intrinsic buffering.

-Bennett

Attachment: _bin
Description: