I've put together a package that allows IPS to log traffic to an external MySQL database. It continuously monitors the connection to MySQL and restarts snort_inline in standard mode if there are any problems. It also has facilitied to allow HA to function properly.
Let me know if there is any interest and I'll send you the package.
Cheers.
This thread was automatically locked due to age.