Re: Can Snort send it logs a remote DB?

[Paul Schmehl <pauls () utdallas edu>]

--On Tuesday, March 29, 2005 02:23:00 PM -0500 Bill Warren 
<bwarren () optivel com> wrote:

> I have 2 snort boxes that are collecting data and I would like to have a
> 3rd box with running some MySQL to collect the data and then have BASE
> read the data.
>
> So, can this be done?

Of course.

>  If so, would somebody point me to a doc(s) on how
> to do this?
Don't know about docs, but it's really not that hard.  You have to create 
accounts in mysql for each sensor's host.  For example, if sensor number 
one is on host "foo", then you need to create an account in mysql for 
sensor1 () foo domain tld.  If sensor two's host is "faa", then you create an 
account for sensor2 () faa domain tld.  Make sure the sensors have sufficient 
rights to the db (SELECT, INSERT and UPDATE) so they can add events to the 
db.

Then, on each sensor, you edit the "output database" line so that it 
"points" to the db host.

E.g. output database: log, mysql, user=sensor1, password=password 
dbname=snort host=foo.example.com sensor_name=sensor1

Make sure the sensor hosts can access the db host on port 3306 (no firewall 
blocking that port from those hosts) and then just restart the sensors.

You could even run BASE on a fourth host and "point it" to the db to get 
the data.  It's all a matter of telling the software where to look to find 
what it needs.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users