IDS mailing list archives

Partition Snort data in MySQL?


From: "Martin, Michael W" <michael.w.martin () intel com>
Date: Thu, 19 Dec 2002 15:39:12 -0800

Is there a way to partition or segment Snort data stored in MySQL by date?
I'd like to keep a revolving four weeks of data on hand, but my Snort
configuration presents the following issues:

1.  The data.MYD file quickly reaches the file size limitation (4GB) in both
Linux and MySQL.
2.  Truncating the tables wipes out all the data, and I'd like to keep the
most recent data.

I understand the MySQL MERGE command enables partitioning data. Does anyone
have a documented process to configure this with Snort's MySQL datafiles?

Thanks,

Michael


Current thread: