Re: SQL command to clear out the snort database

[Nick Hatch <nick () restek wwu edu>]

That's pretty much what I do too. There is very little in the DB that 
needs to stay.

The first time I cleaned house I dropped every table -- a bit 
overzealous. There are a few entries (like the sensor and schema table) 
which are required. Snort includes the script to create the DB in the 
tarball, you could glance at that script and "work backwards" to see 
what is required and clear everything else.

-Nick

Botwick, Jason (Genworth, Contractor) wrote:

> I use this:
>
> DELETE FROM data;
> DELETE FROM event;
> DELETE FROM icmphdr;
> DELETE FROM iphdr;
> DELETE FROM opt;
> DELETE FROM tcphdr;
> DELETE FROM udphdr;
> DELETE FROM signature;
> DELETE FROM sig_class;
> DELETE FROM sig_reference;
> DELETE FROM reference;
> DELETE FROM reference_system;
> DELETE FROM acid_event;
> DELETE FROM acid_ip_cache;
>
> I forget where I got that, probably Patrick Harper.
>  
--
Nick Hatch
ResTek Consultant
restek.wwu.edu 650-2946



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users