Re: [Snort-users] Snort, Mysql purging

Hi Jack,

I have the same problem with many sensors on customers sites, and instead=
of=20
asking the customer to change the PHP timeout and wait for hours while AC=
ID=20
deletes the alerts.

I ask them to use MySql Control Center which is a Win32 MySql client, del=
etes=20
the alerts in seconds.

Hope this helps ....

Mark


Quoting Jack Snedecor <jsnedecor@geninfo.com>:

> New user....
>=20
> =20
>=20
> I have installed snort, mysql and acid per the published instructions.
> Works great.
>=20
> I am by no means an expert at any of these though.
>=20
> What I have not found is a method to purge the database on a regular
> schedule.
>=20
> I had a minor welchia virus this week that drove the database size way =
up.
> Now
>=20
> acid is taking mins. to build pages. Can someone point me in the righ=
t
> direction?
>=20
> =20
>=20
> Jack Snedecor
>=20
> GiS
>=20
> VP, Network Operations Group
>=20
> -----Original Message-----
> From: Sp0oKeR Labs [mailto:spooker@spooker.com.br]=20
> Sent: Wednesday, December 10, 2003 6:47 PM
> To: Grammer, Christopher S; snort-users@lists.sourceforge.net
> Subject: Re: [Snort-users] Remote NIDS
>=20
> =20
>=20
> At your snort.conf, in all sensors use:
>=20
> =20
>=20
> output database: log, mysql, user=3Duser_snort password=3Dpass_snort
> dbname=3Ddb_snort host=3Dip_server_mysql_acid
>=20
> =20
>=20
> You can create the snort database with create_mysql at contrib/ directo=
ry .
>=20
> Best Regards,
>=20
> =20
>=20
> Sp0oKeR
>=20
> ----- Original Message -----=20
>=20
> From: Grammer, <mailto:christopher.grammer@eds.com> Christopher S=20
>=20
> To: snort-users@lists.sourceforge.net
> <mailto:snort-users@lists.sourceforge.net> =20
>=20
> Sent: Wednesday, December 10, 2003 7:03 PM
>=20
> Subject: [Snort-users] Remote NIDS
>=20
> =20
>=20
> I am looking for a method to have remote NIDS log alerts to a central
> SNORT/Acid box running MySQL and Redhat 9.0.
>=20
> Anyone have a link for docs on this or recommendations?
>=20
> =20
>=20
> Chris
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.net email is sponsored by: IBM Linux Tutorials.
> Become an expert in LINUX or just sharpen your skills. Sign up for IBM=
's
> Free Linux Tutorials. Learn everything from the bash shell to sys admi=
n.
> Click now! http://ads.osdn.com/?ad_id=3D1278&al...371&op=3Dclick
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...=3Dsnort-users
>=20





-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users