Re: Snort-users digest, Vol 1 #4029 - 2 msgs

[jayesh <jayesh () cins unipune ernet in>]

On Mon, 2004-03-08 at 09:35, snort-users-request () lists sourceforge net
wrote:
> Send Snort-users mailing list submissions to
>       snort-users () lists sourceforge net
>
> To subscribe or unsubscribe via the World Wide Web, visit
>       https://lists.sourceforge.net/lists/listinfo/snort-users
> or, via email, send a message with subject or body 'help' to
>       snort-users-request () lists sourceforge net
>
> You can reach the person managing the list at
>       snort-users-admin () lists sourceforge net
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Snort-users digest..."
>
>
> Today's Topics:
>
>    1. Barnyard 0.2.0 beta1 is available (Andrew R. Baker)
>    2. RE: Question about best hardware (Jason Haar)
>
> --__--__--
>
> Message: 1
> Date: Sun, 07 Mar 2004 08:26:22 -0500
> From: "Andrew R. Baker" <andrewb () snort org>
> To: Snort-users <Snort-users () lists sourceforge net>
> Subject: [Snort-users] Barnyard 0.2.0 beta1 is available
>
> After a long break since the release of Barnyard 0.1.0, the first beta 
> of Barnyard 0.2.0 is now available for download at
>
>       http://sourceforge.net/projects/barnyard/
>
> In all honesty, this should probably be called an alpha release since I 
> have only minimal testing on it.
>
> Changes in 0.2:
>
> * New command line for batch processing mode
> * New output plugins:
>      op_sguil - output plugin for sguil
>      op_alert_syslog2 - syslog alerting by sending udp datagrams
> * Updated spooling system
>      fixed several ugly edge cases with bookmark files
> * New command line option '-n'.  This causes only new
>      data to be processed in continual processing mode if 1)
>      bookmarking is not enabled, 2) the bookmark file is corrupt,
>      or 3) the bookmark file does not exist
>
>
> Please let me know of any problems.
>
> -A
>
> PS. I still have not gotten around to putting Postgres support in.  I 
> will try to get it in for beta2.
>
>
>
>
>
> --__--__--
>
> Message: 2
> Subject: RE: [Snort-users] Question about best hardware
> From: Jason Haar <Jason.Haar () trimble co nz>
> To: snort-users () lists sourceforge net
> Organization: Trimble Navigation Ltd.
> Date: Mon, 08 Mar 2004 09:02:24 +1300
>
> On Sat, 2004-03-06 at 07:07, Kreimendahl, Chad J wrote:
> > Hardware won't be your problem.  Once you get around 100k events in the
> > snortdb on MySQL you'll run into major performance problems that almost
> > no amount of hardware seems to solve.
>
> You're dead right there. 100K does appear to be the limit for me too.
>
> Is this a MySQL-specific issue? How does Postgresql or Oracle handle DBs
> over 100K?
>
> Has anyone tried to figure out the problem? There are apparently people
> using MySQL with terrabytes of data (nothing to do with snort), so why
> is 100K of snort records such a big deal?
>
> Cheers
>
> Jason Haar
> Information Security Manager, Trimble Navigation Ltd.
> Phone: +64 3 9635 377 Fax: +64 3 9635 417
> PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
>
>
>
>
>
> --__--__--
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-users
>
>
> End of Snort-users Digest



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users