Snort mailing list archives
Re: ACID Archiving on Postgresql
From: leE <lee () nerds org uk>
Date: Fri, 7 Sep 2001 03:02:49 +0100
On Thu, Sep 06, 2001 at 01:13:51PM -0400, Fraser Hugh wrote:
It appears that the pre-processors do not include a sig_class_id or sig_priority. If specified in the insert statement, they're required to be int8 values, but they're not required fields. However, the archive code explicitly copies these values over, and postgres balks because the fields aren't int8. There's a few solutions, probably in order of preference, but I'm not one for the developers and don't understand the implications. 1. Change the archiving code to exclude NULL fields. 2. Change the plugins to include a non-NULL value for these fields. 3. Add a trigger to the signature table to force a value for the fields. Not having the time to dig through the code, this was my quick solution.
I've attached a patch for acid_common.inc - it lacks any kind of grace or finesse, but it does sort the problem out ;) Lee -- Lee Brotherston - <lee () nerds org uk> http://www.nerds.org.uk
Attachment:
acid_common.patch
Description:
Current thread:
- RE: ACID Archiving on Postgresql Fraser Hugh (Sep 06)
- Re: ACID Archiving on Postgresql leE (Sep 06)
- <Possible follow-ups>
- Re: ACID Archiving on Postgresql roman (Sep 07)