Re: Performance Question (output)

[Seth <sethsec () gmail com>]

Whether the database is on the same machine as the sniffing interface
or not, you always want to use the unified output plugin, and have
barnyard insert the data into the database, especially when
performance concern.  .

-Seth

On Wed, Jul 16, 2008 at 4:30 PM, Stewart L <stewartl42 () gmail com> wrote:
> So, I'm a little confused with output...
>
> For performance (sniffing Gig networks) would I be better off using the
> database output module and writing directly to the database? Or should I be
> doing unified logging and importing that to the database with barnyard?
>
> I'm guessing writing directly to the database would be faster for remote
> sensors, but I've been wrong before. :)
>
> Would the same apply if the database was on the same machine as the sniffing
> interface?
>
> FYI, I'm planning on having one central database server that will also have
> at least one sniffing interface (possibly up to three) and 3-4 remote
> network sensors.  the Central box is Beefy (Four multi-core processors, 16GB
> of Ram and 1.2TB of disk).
>
> --
> Stewart
> --
> You only lose what you cling to.
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
> Build the coolest Linux based applications with Moblin SDK & win great
> prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users