Snort mailing list archives
Archiving events via BASE
From: David Ryan <David.Ryan () Quintiles com>
Date: Fri, 22 Jun 2007 11:22:45 +0100
All, I have a question about archiving/deleting events from a mysql database. At the moment I have snort logging alerts to mysql and I am looking at the data via BASE 1.3.6. I have BASE configured with an archive database and I sometimes use the archive function to move alerts that are no longer interesting. There seems to be a problem with the archiving function, but I don't know if I am using it incorrectly. I had one particular alert with 15,000+ events, so I went in to the view of unique alerts, selected the relevant icon on the list and selected 'archive (move) selected' from the actions. After a long time the transaction seemed to finish OK, but when I went in to look at it again there was still some large number of these events . . . maybe 5,000+. I checked the archive database and many of the entries had been moved. I repeated the procedure and it came down to 1,000+ events. Then I repeated it and it left 1. No matter how many times I repeat, this 1 event will not move. So, here's the question - how come when I asked BASE to move all the records of a particular type it only moved part of them, and how come it refuses to move the last transaction ? It makes me a bit wary of the archive funtion if it has this type of issue. Also, is there some other front end that people can recommend for manipulating the data ? I presume I can do it nativley via sql commands, but I'm not up to speed with these commands to be confident of doing it correctly. Thanks, David =========================================== David Ryan IT Security Engineer, Global IT Security Quintiles, Global IT - Infrastructure, QDUB david.ryan () quintiles com v: +353-1-819-5186, GMT+0 m: +353-87-124-9108 =========================================== ********************** IMPORTANT--PLEASE READ ************************ This electronic message, including its attachments, is COMPANY CONFIDENTIAL and may contain PROPRIETARY or LEGALLY PRIVILEGED information. If you are not the intended recipient, you are hereby notified that any use, disclosure, copying, or distribution of this message or any of the information included in it is unauthorized and strictly prohibited. If you have received this message in error, please immediately notify the sender by reply e-mail and permanently delete this message and its attachments, along with any copies thereof. If this electronic message contains a zipped attachment and you do not have a decompression tool, you may download unZIP (free of cost) from: http://www.mk-net-work.com/us/uz/unzip.htm. Alternatively, you may request that the attachment be resent in an uncompressed format. Thank you. ************************************************************************
------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Archiving events via BASE David Ryan (Jun 22)
- <Possible follow-ups>
- Re: Archiving events via BASE a0037 (Jun 22)
- Re: Archiving events via BASE Info (Jun 22)