Snort mailing list archives
Re: modifying priority on certain rules
From: Frank Knobbe <frank () knobbe us>
Date: Wed, 22 Feb 2006 15:15:28 -0600
On Wed, 2006-02-22 at 11:42 -0500, Christina McAghon wrote:
I think I figured out the problem. I am using Barnyard to log the events to a database. In the signature table, there was an existing entry for the sig id, which had the lower priority. Once I removed it from the signature table, it recreated it with the higher priority.
Of course by doing so (only deleting the row from the signature table), you probably have bunch of orphaned entries in your event table that reference a signature that does not longer exist. If you remember the signature.sig_id of that sig, you might want to set event.signature to signature.sig_id of the new signature where all instances of event.signature are like the old signature.sig_id.
Has anyone else seen this? If so, do you manually purge/update the entry in the signature table?
Bear in mind that all entries are interconnected in the database. If you remove portions, you leave dead data hanging around. If you want to meddle in the database by hand, I suggest you gain an understanding of the whole schema so you can perform manual tasks without disrupting any indices's. Cheers, Frank -- It is said that the Internet is a public utility. As such, it is best compared to a sewer. A big, fat pipe with a bunch of crap sloshing against your ports.
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- modifying priority on certain rules Christina McAghon (Feb 21)
- Re: modifying priority on certain rules sekure (Feb 21)
- Re: modifying priority on certain rules Andreas Östling (Feb 21)
- Re: modifying priority on certain rules Christina McAghon (Feb 21)
- Re: modifying priority on certain rules Andreas Östling (Feb 22)
- Re: modifying priority on certain rules Dirk Geschke (Feb 22)
- Re: modifying priority on certain rules Christina McAghon (Feb 21)
- <Possible follow-ups>
- Re: modifying priority on certain rules Christina McAghon (Feb 22)
- Re: modifying priority on certain rules Frank Knobbe (Feb 22)