10pm. 527548 events logged by Snort since 7pm last night (the last database purge). The vast majority of those was during office hours today; not surprising given the general peak traffic time on the network. Snorby is holding up well although ruby seems to consume a lot of resources, and I managed to crash the server by using the email a report function (it tried to run an SQL query that was over 4.8 MILLION characters long – 2 hours at max system resources and it finally tipped over). Other than that all is looking good.
I recently setup a Snort sensor on a dedicated box and initially had it all running and happy. Then I stumbled across Snorby, and thought “that looks pretty mint, I might try that out” as BASE just wasn’t doing it for me on its own. In this article I’ll try and piece together a little about what the initial set-up was and how I managed to get Snorby up and running (and how I managed to get stuck several times along the way).