Skip navigation.
Home

Snort/SQL logger

The Snort/SQL Logger project. Also known as slogger

Dev Notes

(From Samir's blog)
dev notes:

language of choice atm is C++.
need support for mysql/postgres/sqlite (maybe)
possible solutions: SOCI: http://soci.sourceforge.net/
QT4 (no point doing qt3)
gtkmm (ie. gtk+)
wxwidgets

For the backend C++ is the very obvious choice. I agree with that. I was looking at SOCI and that does look like it will do what we need. Abstraction of the DB languages, that way we just say what backends are used. I also dont think that doing any sql parsing on the sensors would be a good idea.

Roadmap to 0.1

sloggerd
1) Stable with MySQL, Postgress, and Oracle.
2) detect loss of database connection and re-establish with out loss of data
3) Work properly with multiple daemons on one server
4) Single server to handel multiple servers.
5) Good logging of statics
6) mailing of alerts to specified address for a specific time frame.
7) Good debugging logging

Sensord
1) Able to start at any time.
2) Detect is snort dies and alert on it.
3) Able to log to multiple sloggerd's
4) Detect if it losses connection to sloggerd and reconnect

Syndicate content