AW: (Snort-users) Snort on multiple interfaces

[<sandro.poppi () wacker com>]

> I am about to deploy snort with 2 promiscuous nics in it.
> Will I run into
> any issues when both sensors are trying to write to the alert
> log on the
> local machine? I need these logs for dsheild and aris. I know
> from logging
> to the database there are no issues. Anyone have any problems?
I'm running 5 sensors on one machine logging to syslog. As long as you use the
output alert_syslog facility there should be no problem since your syslogd is
designed for this configuration.

If you want to use a single file for all sensor I would recommend sending the
alerts to own files per sensor and merge them using a short shell script.

HTH,
Sandro


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users