Snort mailing list archives
performance question
From: "Stewart L" <stewartl42 () gmail com>
Date: Wed, 16 Jul 2008 16:30:03 -0400
So, I'm a little confused with output... For performance (sniffing Gig networks) would I be better off using the database output module and writing directly to the database? Or should I be doing unified logging and importing that to the database with barnyard? I'm guessing writing directly to the database would be faster for remote sensors, but I've been wrong before. :) Would the same apply if the database was on the same machine as the sniffing interface? FYI, I'm planning on having one central database server that will also have at least one sniffing interface (possibly up to three) and 3-4 remote network sensors. the Central box is Beefy (Four multi-core processors, 16GB of Ram and 1.2TB of disk). -- Stewart -- You only lose what you cling to.
------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- performance question Stewart L (Jul 16)
- Re: performance question Joel Esler (Jul 16)