Snort mailing list archives

mysql/snort backup issue


From: "John Byrnes" <JohnByrnes () alliantenergy com>
Date: Wed, 24 Sep 2003 11:14:48 -0500

Hello-
 
I'm using the mysqldump script to backup my snort database. I then truncate my tables. by the following
 
TRUNCATE `acid_ag`;
TRUNCATE `acid_ag_alert`;
TRUNCATE `acid_event`;
TRUNCATE `acid_ip_cache`;
TRUNCATE `data`;
TRUNCATE `event`;
TRUNCATE `icmphdr`;
TRUNCATE `iphdr`;
TRUNCATE `opt`;
TRUNCATE `reference`;
TRUNCATE `reference_system`;
TRUNCATE `sensor`;
TRUNCATE `sig_class`;
TRUNCATE `sig_reference`;
TRUNCATE `signature`;
TRUNCATE `tcphdr`;
TRUNCATE `udphdr`;
 
After I do this, I have to restart all of my sensors to get them to resume inserting events in the db. (This is my 
problem) I'm assuming this is because the mysqldump script must lock the db for inserts, and snort must stop trying if 
the db is unavailable, and doesn't retry. I could be completely wrong.
 
Has anyone else noticed this?
 
Thanks,
John B
 
 
 


Current thread: