next up previous contents
Next: Changing Alert Order Up: Network Intrusion Detection System Previous: Understanding Standard Alert Output   Contents

High Performance Configuration

If you want Snort to go fast (like keep up with a 1000 Mbps connection), you need to use unified logging and a unified log reader such as barnyard. This allows Snort to log alerts in a binary form as fast as possible while another program performs the slow actions, such as writing to a database.

If you want a text file that's easily parsed, but still somewhat fast, try using binary logging with the ``fast'' output mechanism.

This will log packets in tcpdump format and produce minimal alerts. For example:

    ./snort -b -A fast -c snort.conf



Eugene Misnik 2013-05-08