Re: Configuration Questions

[Erek Adams <erek () snort org>]

On Wed, 26 Mar 2003 August.K.Kunnecke () pmusa com wrote:

> I realize this is probably a common set of questions, but I could not find
> it in the archives:
>
> I am trying to load Snort on a Windows 2000 box. There are several
> configurations to pick from. I am wondering if one offers any advantage over
> the others. Here are the combinations I know about:
>
> Snort, MySQL, ACID, IIS
> Snort, IIS, SnortSnarf
> Snort, Apache, SnortSnarf
> Snort, MySQL, Apache, ACID
> Snort, MySQL, Slave, ACID
>
>
> I realize one difference between IIS and Apache is Microsoft vs.
> non-Microsoft, but I was wondering what other reasons there are to pick one
> over the other. (not only for Web server, but for database, graphs, etc)

The biggest:  Personal preference.  No, that's not the answer that you
really wanted, but it's an honest one.  :)  I'd suggest that you forget
about any 'flavors' until you get Snort running.  Once it works, then add
to the mix.  It's like making a fine gumbo--You start with a simple roux,
and then build layers of flavor upon that.  :)

> I did find good installation instructions on Silicon Defense, but I was
> wondering if anyone could point me to a site where there is more on running
> and troubleshooting Windows 2000 issues. (especially adding more sensors)

The most common issue is that you don't have a 'sensor_name' parameter set
on your DB output line.  Check this [0] for more details.

If I'm barking up the wrong tree, give us some more details about your
problem and we'll see what we can do.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


[0]     http://www.snort.org/docs/writing_rules/chap2.html#tth_sEc2.5.8


-------------------------------------------------------
This SF.net email is sponsored by:
The Definitive IT and Networking Event. Be There!
NetWorld+Interop Las Vegas 2003 -- Register today!
http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users