snort+mysql+acid

[Alan McCarty <amccarty () ecornell com>]

Hi all-
I'm running well so far with a distributed snort setup.  I have a big 
tank of a server running mysql/acid/snortcenter, with smaller snort 
sensors on various remote subnets.
I'd like to know if anyone has come up with a simple solution to 
centralized instant notification of alerts, other than logwatchers, 
etc. I have read posts of people hacking code to replace smb_client 
messaging with sendmail commands, using syslog, snmp trapping, etc.  
However, these notifications come from the sensors, not the central 
server. I realize I can forward this information to our central server 
and then on from there, but the information is already on the server, 
stored in the mysql database.
I imagine this has been considered, but is there a good reason why it 
hasn't been implemented in any way?  It seems like an elegant add-on to 
what is so far a very solid IDS solution.

Thanks for any input.
-Alan



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users