[prev in list] [next in list] [prev in thread] [next in thread]
List: snort-users
Subject: [Snort-users] Installation - Snort/MySQL/Apache all on one box vs
From: "Humes, David G." <David.Humes () jhuapl ! edu>
Date: 2007-08-16 20:00:25
Message-ID: A37E72066F5DD941A2CDD68252DB54B5031BC2E7 () aplesnation ! dom1 ! jhuapl ! edu
[Download RAW message or body]
--===============1193473984==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C7E040.162CF108"
This is a multi-part message in MIME format.
I was wondering if anyone could discuss their experience and pros and
cons of setting up Snort with everything all on the same box, as
described in Patrick Harper's guides, vs using a separate server for the
database and http server. On the surface, it would seem to make sense
to offload the database and analysis functions to a dedicated system so
the sensors are not burdened with running the database and http server.
Plus analyst activity can place a load on the system when dealing with
large numbers of events. But, then the database server becomes a single
point of failure for the remote sensors. So, I would have to have some
way to rapidly recover a failed database server such as running it from
a VM that I could push to another machine, hot spare, etc. Are there
significant performance gains to be realized by offloading the database,
web server, and analyst activity to a dedicated server? Are there
technical issues with making this work?
Thanks.
Dave Humes
Johns Hopkins University Applied Physics Laboratory
Telecommunications Group (ITC)
david.humes@jhuapl.edu
443-778-6651
[Attachment #3 (text/html)]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>Installation - Snort/MySQL/Apache all on one box vs dedicated MySQL/Apache \
server</TITLE> </HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">I was wondering if anyone could discuss their experience \
and pros and cons of setting up Snort with everything all on the same box, as \
described in Patrick Harper's guides, vs using a separate server for the database and \
http server. On the surface, it would seem to make sense to offload the \
database and analysis functions to a dedicated system so the sensors are not burdened \
with running the database and http server. Plus analyst activity can \
place a load on the system when dealing with large numbers of events. But, then \
the database server becomes a single point of failure for the remote sensors. \
So, I would have to have some way to rapidly recover a failed database server such as \
running it from a VM that I could push to another machine, hot spare, etc. Are \
there significant performance gains to be realized by offloading the database, web \
server, and analyst activity to a dedicated server? Are there technical issues \
with making this work?</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Thanks.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Dave Humes</FONT>
<BR><FONT SIZE=2 FACE="Arial">Johns Hopkins University Applied Physics \
Laboratory</FONT>
<BR><FONT SIZE=2 FACE="Arial">Telecommunications Group (ITC)</FONT>
<BR><FONT SIZE=2 FACE="Arial">david.humes@jhuapl.edu</FONT>
<BR><FONT SIZE=2 FACE="Arial">443-778-6651</FONT>
</P>
<BR>
<BR>
</BODY>
</HTML>
[Attachment #4 (--===============1193473984==)]
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic