RE: Random IDS Thoughts [WAS: Re: IDS thoughts]

["Mike Lyman" <mlyman () west-point org>]

> You mention SQL query skills.  Are you capturing events right to SQL
> databases, or to text-based logs later imported?
>
> If you are capturing right to SQL-based logs, any performance
issues?

We do a mix of both. There are places where we get considerable data
but not enough to be of concern and that has long gone straight to SQL
dbs. (Microsoft SQL Server in our case) We've got other areas like our
commercial IDSes where we get considerable data that I'd expect to
overwhelm the database but have not. We've overwhelmed the network
going into our main SQL Server but going to gig ethernet took care of
that. We have storage issues (until our SAN is upgraded in a few
months) but not many performance issues unless we're doing some very
complex queries. In those cases we usually pull the data to other
servers and work there. 

There are areas where we historically had database performance
concerns so we left the logs going to text format for later import and
have not yet tried going straight to SQL Server with them yet. In
those cases we've built some other process looking for things of
interest based on the analysis we've done on the imported logs.

Mike Lyman
mlyman () west-point org


-------------------------------------------------------------------------------
INTRUSION PREVENTION: READY FOR PRIME TIME?

IntruShield now offers unprecedented Intrusion IntelligenceTM capabilities
- including intrusion identification, relevancy, direction, impact and analysis
- enabling a path to prevention.

Download the latest white paper "Intrusion Prevention: Myths, Challenges, and Requirements" at:
http://www.securityfocus.com/IntruVert-focus-ids2
-------------------------------------------------------------------------------