Re: Homebrew unified2 processing vs barnyard2

[K D <korodev () gmail com>]

While I certainly agree barnyard2 and the log to db process is one of the
last places a snort admin should look to performance optimization, I was
more inquiring to barnyard2's performance, stability, and current reputation
in the snort community, wondering if there were any major complaints.

However, I am very interested in any *SQL alternatives that might be
available. Has there been any progress or public research regarding
flat-file, schema-less, or high performance embedded database storage?

\\korodev



On Mon, Jul 19, 2010 at 9:48 PM, Jason Haar <Jason.Haar () trimble co nz>wrote:

>  On 07/20/2010 07:14 AM, K D wrote:
> > True, I suppose I'm wondering if barnyard2's performance leaves much
> > to be desired in the snort community.
>
> Aren't you dwelling on the wrong thing here? snort has to look at
> truckloads of network traffic, and records to file the events it thinks
> are interesting. i.e. the file is empty most of the time (people
> alerting >1 per sec are out of scope for this discussion ;-). Then
> barnyard monitors that file and creates SQL,syslog,etc events based on
> what it finds.
>
> Almost all the overhead/bottlenecks in a snort NIDS are on the
> collection and presentation (eg base) ends. Barnyard overhead is a mere
> blip in comparison.
>
> What we are all seeing is that *SQL is a slow backend to use as a
> frontend. Solving that is hard(ware) - or just move to Sourcefire's
> commercial solution - which doesn't use SQL ;-)
>
> --
> Cheers
>
> Jason Haar
> Information Security Manager, Trimble Navigation Ltd.
> Phone: +64 3 9635 377 Fax: +64 3 9635 417
> PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
>
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users