Re: Mysql problem

["Imran William Smith" <iwsmith () mimos my>]

Messagedata.MYD is the mysql 'data' file (MYI is the index file).  The 'data' file in the
snort database schema contains the payloads (and probably should have
been called 'payload', not 'data').

One guess, is that you may have hit one of the upper limits for MySQL data size,
since it is usually the payload table that grows fastest.

One limit is the maximum number of rows per table, you can change this
within mysql (either at create table time, or alter table).  I can't remember
the exact parameter.  It's tied up with the idea of average row size.  So you
can get around this limit.

The other limit is that some OS's can't create a file > 4Gb (2^32).  Others
can.  This is not a MySQL limitation, really.  But MySQL 3.x can't make a database
table spread over a number of files.  Not sure whether 4.x can.

Good luck

--
Imran William Smith
Security Products Development
Mimos Bhd, Malaysia



  ----- Original Message ----- 
  From: Steve Moran 
  To: snort-users () lists sourceforge net 
  Sent: Thursday, June 20, 2002 10:14 PM
  Subject: [Snort-users] Mysql problem


  I have some rules set up to monitor surfing, which generate a ton of alerts.  Like 70,000 alerts a day.  The problem 
is, when I try to delete, archive, or anything other than view some of the alerts when I have that many I get a 
'Database ERROR:Database ERROR:Can't open file: 'data.MYD'. (errno: 145)'
   
  Anyone else see this with large #'s of alerts?  Or have any idea how to fix it.