Snort mailing list archives
Performance Question
From: Martin Bündgens <mb () insidetheweb de>
Date: Fri, 20 Feb 2004 02:49:00 +0100
Hallo, i installed Snort 2.01 as SuSE 9 RPM. The programm itself logs all rule faults in /var/log/snort as complete snort.log + creates for all ips an extra folder inclusive the fault message as single file from the ip. My first question, is this a common option that snorts creates an extra folder for all ips ? If not, how to deactivate it. Second question, can these tons of folders/files (about 2000-5000) can effect the server performance ? I don`t think so, but one person from our data center insists on that the "snort" logging process is the problem for high loads in combination with logrotate. Thanks for your time. Regards, Martin Bündens ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- NetSky worm signature definition...!!! Semerjian, Ohanes (Feb 18)
- <Possible follow-ups>
- RE: NetSky worm signature definition...!!! Tim Hergert (Feb 19)
- RE: NetSky worm signature definition...!!! Shane Williams (Feb 19)
- Performance Question Martin Bündgens (Feb 19)
- Re: Performance Question twig les (Feb 19)
- RE: NetSky worm signature definition...!!! Semerjian, Ohanes (Feb 19)