Re: Diagnosing MySQL server has gone away messages

[Joel Esler <joel.esler () sourcefire com>]

When snort logs to db, it takes resources away from inspecting  
traffic.  Missing packets.

--
Joel Esler
Sent from the road.

On Aug 21, 2007, at 10:33 AM, bleh <mailbox.size.limit () gmail com> wrote:

> Can you explain what you mean by Snort "has to stop being an IDS"?  
> If Snort is no longer an IDS when logging directly to a DB what is it?
>
> > In order for Snort to do an insert, it has to stop being an IDS.
> > Personally, I don't want my IDS to miss any packets, regardless of  
> the
> > extremely short amount of time it takes to do a DB insert.   
> (Unless you
> > have a very busy DB).
> >
> > Still would rather you use Barnyard and Unified.
> >
> > Joel
> >
> > Jason Haar wrote:
> >> Joel Esler wrote:
> >>> As a general recommendation for everyone on the list, Snort  
> should never be logging directly to the DB.
> >>>
> >>>
> >> Can you tell me why that is? I mean, surely directly accessing a DB
> >> doesn't introduce much latency/load *unless* it continually  
> generates
> >> events?
> >>
> >> i.e. if a particular installation of snort only generates 1 event  
> per
> >> minute, is there really any difference between snort->mysql and
> >> snort->barnyard?
> >>
> >> I could understand it being a problem if snort is having to queue  
> up
> >> events while INSERTs are going on, but if that are spaced many  
> seconds
> >> apart...?
> >>
> >
> > --
> >
> >
> > --
> > joel esler | security consultant | Sourcefire | pgp is public
> --- 
> ----------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a  
> browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users