Re: Combining SNORT databases....

[Alejandro Flores <alejandrorflores () gmail com>]

Hi there,

> I've setup SNORT traces in 2 different MySQL databases (A and B).
> I would like to move SNORT data from B > A.
> Can I simply extract data from B and import it in to A?
> A and B are using the same db schema.

You can do this way if the sensor ID in each database has a different
value. I mean, you have all data logged in your database A, with
sensor id = 1, and in your database B you have the sensor id = 2.
If not, you'll have to change the SID in one of your databases.
A better way is:
1 - Log both using unified format
2 - Copy the binary file to the destination server
3 - Use Barnyard to post-process the logs, each with a different
barnyard.conf with a different SID. (barnyard-A.conf,
barnyard-B.conf).

Regards,
Alejandro


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users