Snort mailing list archives
Re: what's the difference between alert_fast and alert_unified?
From: zhaohui yin <yinzhaohui () gmail com>
Date: Sat, 22 Oct 2005 09:31:59 +0800
thanks. I am use snort output to mysql , use unified output can transfer to mysql input? On 10/21/05, Matt Kettler <mkettler () evi-inc com> wrote:
zhaohui yin wrote:Hi all: I am confused the snort option about alert_fast /alert_unified, and want to known in which mode ,snort will run fastest.unified is faster than alert_fast. "alert_fast" is a text-mode log for alerts, and while it's fast for text mode, and much faster than alert_full, it's still a text log. However, alert_unified is a binary format and you need to use barnyard to post-process the alerts into readable text. The unified binary format lets snort dump the alerts to disk with an absolute minimum amount of overhead, as it doesn't need to look up the alert descriptions, etc when logging.I run snort with -b -A fast option, any suggestion?By using -b you're already getting some speed benefit, as your packet log is binary. Unified would extend this and make both your packet and your alert logs binary.
-- yinzhaohui ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- what's the difference between alert_fast and alert_unified? zhaohui yin (Oct 20)
- RE: what's the difference between alert_fast and alert_unified? Patrick Harper (Oct 21)
- Re: what's the difference between alert_fast and alert_unified? Matt Kettler (Oct 21)
- Re: what's the difference between alert_fast and alert_unified? zhaohui yin (Oct 21)
- RE: what's the difference between alert_fast and alert_unified? Patrick Harper (Oct 21)
- Re: what's the difference between alert_fast and alert_unified? zhaohui yin (Oct 21)
- Re: what's the difference between alert_fast and alert_unified? zhaohui yin (Oct 21)