I think that writing and maintaining code capable of interpreting such dynamic configuration would be cool, but I think that the cost/benefit ratio isn't there. True, it would be convenient to have just one config for everything, but that's only partially true anyway, since each sensor needs it's own specifics for topology, etc. That means that you're already doing per-sensor configuration somewhere along the way, and so all you're really saving is duplicating config lines. I just have a few templates lying around that I use and it seems to work just fine. It also makes parsing configs much, much easier when they are declarative and not conditional (i.e. when you want to create configs via script).<br>
<br>--Martin<br><br><div class="gmail_quote">On Tue, Feb 10, 2009 at 2:49 AM, Victor Julien <span dir="ltr"><<a href="mailto:lists@inliniac.net">lists@inliniac.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<div><div></div><div class="Wj3C7c"><br>
Martin Fong wrote:<br>
> Matt,<br>
><br>
>> So we're only loading certain modules for detection if they are<br>
>> specifically called for? I.e. don't load the pcre module if there are no<br>
>> rules asking for pcre?<br>
><br>
> One specific use case is having two different set of preprocessor<br>
> parameters depending on whether the sensor is in front of or behind<br>
> a firewall -- this would eliminate the need for building two different,<br>
> but mostly identical, configuration files.<br>
<br>
</div></div>I understand your goal and I like it. However one of our goals is to<br>
make the configuration & tuning less complex. Adding this type of<br>
complexity could conflict with that goal. On the other hand just having<br>
to configure one config that could be deployed everywhere in your<br>
organization may make it simpler again... thoughts?<br>
<br>
Cheers,<br>
Victor<br>
<br>
- --<br>
- ---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
- ---------------------------------------------<br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.9 (GNU/Linux)<br>
Comment: Using GnuPG with Mozilla - <a href="http://enigmail.mozdev.org" target="_blank">http://enigmail.mozdev.org</a><br>
<br>
iEYEARECAAYFAkmRP6wACgkQiSMBBAuniMdmsQCbBRAuRmJXP++QVye6fBmjHDDY<br>
9UEAn2axA1U+Cuv56931Fi/AUAq4YQIB<br>
=Nbj1<br>
-----END PGP SIGNATURE-----<br>
<div><div></div><div class="Wj3C7c">_______________________________________________<br>
Discussion mailing list<br>
<a href="mailto:Discussion@openinfosecfoundation.org">Discussion@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/discussion" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/discussion</a><br>
</div></div></blockquote></div><br>