RE: Using snort on a per-instance basis....archive databases

["Matthew K. Lee" <mattl () rycan com>]

Jason,

I think that quickest solution would be to create a database on your
home network to house any archival information.  Your primary database
would obviously be on the laptop.  In the acid_conf.php page, you could
set the archival database to the database server on your home network.
When you bring the laptop "home", you could move all of the alerts to
the waiting archive database.  To do this quickly, you could simply the
"Total alerts", and then from the action menu choose "Archive alert(s)
(move)", and then click the "entire query" button.

This will move the remote information over to the archive database
(which is on your home network).

Best of luck!

Matthew Lee
 
-----Original Message-----
From: Jason Humes [mailto:jhumes () acs on ca] 
Sent: Friday, October 29, 2004 8:31 AM
To: 'snort-users () lists sourceforge net'
Subject: [Snort-users] Using snort on a per-instance basis....archive
databases

Hi
I would like to know if there is someway to backup and clean the
mysql/snort
database after each use of snort...basically we've got it running on a
notebook and when a client calls with a problem we usually drop the
snort
notebook on their network for a week or so...I'm currently just using
acid
to manually delete all the alerts in between each customer, but this
takes
long and I don't really want to have to loose the data.  I would love to
be
able to archive the database after each customer deployment and clean
the
database back to a pristine state.  Can this be done?  I've got webmin
installed on this box if that helps me out at all.  Thanks.  Could I
then,
after archiving the database for customerX, pull that archive back up
and
run through acid for analysis?  Thanks.

--

Jason


-------------------------------------------------------
This Newsletter Sponsored by: Macrovision 
For reliable Linux application installations, use the industry's leading
setup authoring tool, InstallShield X. Learn more and evaluate 
today. http://clk.atdmt.com/MSI/go/ins0030000001msi/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_idU88&alloc_id065&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users