Re: Does snortsnarf work?
Paul Schmehl <[email protected]> 13 Feb 2003 11:02:53 -0600
| Newsgroups | gmane.comp.security.ids.snort.snarf |
|---|---|
| Organization | The University of Texas at Dallas |
| Message-ID | <1045155773.15028.19.camel@utd49554> |
On Thu, 2003-02-13 at 10:48, James Hoagland wrote: > > Try running it from the command line and observe its memory and CPU > use. If these increase, it is working on processing alerts. If > there are alot of alerts to process, SnortSnarf can take a while. > But it should eventually complete successfully. I've done it from the commandline. Just trying to process one day from the database takes at least two hours, and memory consumption continually increases until it's reached the limit. (I'm using a 1.3 GHz processor/1GB RAM FreeBSD box.) I even ran it through cron last night. No errors - no output. One time when I ran it, I saw some warning messages about uninitialized values (coming from a perl module), but those aren't fatal, so they shouldn't keep it from finishing. I'll try it again today and see if I can take a smaller sample. -- Paul Schmehl ([email protected]) Adjunct Information Security Officer The University of Texas at Dallas http://www.utdallas.edu/~pauls/ AVIEN Founding Member