Recommend good IDS? was Re: /dev/shm/r?

[john <lists.john@gmail.com>]

On Tue, Jun 2, 2009 at 4:45 PM, Josh Lauricha <josh@lauricha.com> wrote:
> I'm surprised more people aren't running tripwire or other IDS.

I'd be interested to hear some recommendations for IDS to run on
internet facing servers. Especially from the point of view of ease of
installation, ease of maintenance, quality of the tool, and ability to
have it deliver really useful information to the admin. I've used
SNORT a bit in the past and my feeling was that it was so chatty that
it was actually hard to tell if something bad was happening or not.

John