Re: portscan questions...

[roman () danyliw com]

Shawn,

> I was trying to look at the portscan log using acid and I get an error:
> "Maximum execution time of 30 seconds exceeded in
> /home/httpd/html/acid/acid_stat_ipaddr.php on line 118"  is there anyway to
> extend this time?  I tried altering the "max_execution_time" variable in   
> acid_conf.php but that only modifies executions going to the database.     
> (it's set to 580 now)

I assume you mean you modified the $max_script_runtime variable.

Well, it looks like the value of max_script_runtime is not being
propogated everywhere that it should in ACID (read: a bug).  A 
work-aournd for this issue is to modifying the max_execution_time in      
config file (php.ini) of the PHP engine.
                       
A patch has also been committed to CVS to correctly set the
max_execution_time based on the setting of max_script_runtime in
acid_conf.php.  This patch will obviate the need to modify the global PHP
configuration.

> Also, is there anyway to store the portscan information into the mysql
> database instead of a file?

No. The schema does not yet support this.

cheers,
Roman


---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users