Snort mailing list archives

Spool Processors


From: Gary_Portnoy () itginc com
Date: Thu, 1 Apr 2004 09:42:34 -0500

I am considering using the unified logging output plugin for snort with a 
spool processor to dump the alerts/logs to MySQL.  As I see it I have 3 
options: Barnyard, Mudpit and Flop.  Flop is out since I don't believe it 
actually reads unified logs, but more importantly it can't support more 
than one snort instance per machine, according to the documentation. 

Can somebody with experience compare and contrast Barnyard and Mudpit? 
What are the major differences?  Why would I pick one over the other?  Is 
one more complete than the other?  Etc, etc, etc.

-------------------------------------------
Gary Portnoy

Current thread: