Honeypots
Problem with Honeywall and MySQL Dec 04 2006 11:15AM
mng3@libero.it (mng3 libero it) (2 replies)
Re: Problem with Honeywall and MySQL Dec 04 2006 04:40PM
Lance Spitzner (lance honeynet org) (1 replies)
Re: Problem with Honeywall and MySQL Dec 04 2006 09:03PM
Mark J. Hufe (mark j hufe wilmcoll edu)
Concerning the database, I'm wondering if this new release might provide
some relief. I have a single honeypot running Linux SUSE 10.0 and the
database on the honeywall becomes unmanageable within a week or two. By
unmanageable, I mean that queries from Walleye take so long that they
are no longer feasible. In particular, I've been trying to track SSH
attacks via Sebek queries and process tree expansion.

I'm either doing something wrong or the recommended minimum hardware
configuration in the online users manual is maybe a little understated.
The honeywall is running on a Pentium 4 desktop at 3.4 GHz with 1 GB of
memory. The online manual lists 256 MB RAM as the minimum with 512 MB
recommended and a minimum Pentium 3 processor.

I forget who advised it, but I've been re-installing as a means of
clearing out the database. Doing so only takes about 5 minutes. If I
recall correctly, the minimum size of the database was set to either 30
or 45 days. Something like a week or two might be helpful for a system
like mine.

I've got an order in to upgrade the server to something more
substantial, but the wheels of purchasing turn oh so slowly.

Is it likely that the Roo upgrade will help?

- Mark

Lance Spitzner wrote:

> Sam, we are working hard to get the new Honeywall CDROM 1.1 out the
> window. Poor Earl is pulling his hair out to squash the final bugs
> (not a pretty site :). We had hoped to have it out already but ran
> into last minute issues and are adding one more feature. The new
> release should resolve issues like these and many others. If you can
> wait a week or two more, you should have the latest and greatest by
> then.
>
> Also, the publicly SVN server is still under the works. Our SVN guru
> got crushed during the Thanksgiving holidays, thus the delay.
>
> Appreciate everyone's patience! :)
>
> lance
>
>

[ reply ]
RE: Problem with Honeywall and MySQL Dec 04 2006 04:19PM
ROPERT François (Francois ROPERT supinfo com)


 

Privacy Statement
Copyright 2010, SecurityFocus