Use Snort in High-Performance Environments with Barnyard
Decouple Snort’s output stage so it can keep pace with the packets.
Snort by itself is fine for monitoring small networks or networks with low amounts of traffic, but it does not scale very well without some additional help. The problem is not with Snort’s detection engine itself, but stems from the fact that Snort is a single-threaded application. Because of this, whenever an alert or log event is triggered, Snort must first send the alert or log entry to its final destination before it can go back to looking at the incoming data stream. This isn’t such a big deal if you’re just having Snort write to a file, but it can become a problem if you are logging to a database, which can cause Snort to wait a relatively long time for the database insert to complete. This of course is exacerbated when you’re having Snort log to a remote database server.
To solve this, another application called
Barnyard is the
equivalent of Snort’s output plug-ins all rolled
into one program, with a frontend for reading in files that Snort
generates and then sending them to the same database or other
destination that you would normally have Snort log to. The only
its limited database support:
only MySQL, whereas Snort supports MySQL,
PostgreSQL, Oracle, and ODBC outputs (
claims to support PostgreSQL, but unfortunately its current ...