Bro log into MySQL

Vern Paxson vern at icir.org
Sun Nov 16 23:51:19 PST 2003


> I was thinking of doing the same thing for MySQL logging, but there seems
> to be little value in that: the logs are pretty much free form text and no
> sensible schema can be designed.

Note that with Bro 0.8's "ALERT" framework, there's an opportunity to now
define such schemas.  That indeed was one of the motivations behind
instituting it, though the policy scripts don't yet make full use of it.

		Vern



More information about the Bro mailing list