Re: [sentinix-list] Snort duration

Bill,
 1600+ alerts in a few minutes seems excessive in my opinion. I would hazard to guess that your overloading your hardware and/or database with alerts.

 Most of those alerts are probably one or two rules that are triggered every second or so, find those rules and disable them, clear the database of alerts and restart your sensors.

 I had network "noise" from Solarwinds server monitors generating 1 event per second here and disable the rule to omit them. It helped performance greatly.

hope this helps,

Michael

-----Original Message-----
From: "OMalley, Bill" <Bill.OMalley-3ekG96uVUrBWk0Htik3J/[email protected]>
Sent: Jan 5, 2004 11:05 PM
To: The SENTINIX Mailing List <[email protected]>
Subject: [sentinix-list] Snort duration

Has anyone else had a problem with Snort running only for a few minutes (1600+ alerts) and then stop recording?  If I stop and start (or reload) the service from Snort Center, I am able to capture more alerts, but only for a short time.

Does anyone have a clue on this?  It is my perception that Snort will run continually unless manually stopped.

Thanks,
Bill O'Malley




THIS MESSAGE MAY CONTAIN INFORMATION THAT IS CONFIDENTIAL AND/OR PROTECTED BY LAW. IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, YOU ARE HEREBY NOTIFIED THAT ANY DISSEMINATION, DISTRIBUTION, COPYING OR COMMUNICATION OF THIS MESSAGE IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED THIS COMMUNICATION IN ERROR, PLEASE  CONTACT  THE SENDER IMMEDIATELY AND DELETE THE MESSAGE.  PLEASE NOTE THAT  ALTHOUGH WE WILL TAKE ALL COMMERCIALLY REASONABLE EFFORTS 
TO PREVENT VIRUSES FROM BEING TRANSMITTED FROM OUR 
SYSTEMS, IT IS THE RESPONSIBILITY OF THE RECIPIENT TO CHECK FOR AND PREVENT ADVERSE ACTION BY VIRUSES ON ITS OWN SYSTEMS .