Snort mailing list archives

manual access to ACID databases


From: "Jones, Benny" <Ben () wcom net>
Date: Wed, 10 Oct 2001 09:50:39 -0400

recent nimda shenanigans has apparently overloaded my
ACID database with 10s of thousands (probably a few
hundred thousand) alerts that I don't want.  The initial
ACID display doesn't come up (the mysqld process simply
chugs away for over an hour).

I'd like to go into the mysql database and use SQL to
delete the records manually, but I'm concerned that
I'll leave the database equivalent of broken links around
if I make a mistake.

Has anyone else successfully dealt with something like this?
If manual access is an option, what is the command to use to
get rid of say, all alerts with "outgoing admin.dll" in them?
Or, maybe I've got something misconfigured.  Any advice would
be appreciated.  

TIA

Benny

Current thread: