RE: event database size

["Wright, Albert John (A J)" <ajw () utk edu>]

In the "contrib" directory of previous versions of snort (2.2.0 maybe?) there was a snort_archdb perl script that still 
works with the current schema.  From what I can tell, it takes care of the problem with data dependencies between the 
various tables.
 
It seems to be somewhat resource intensive.  Our 42Gb database takes an hour or two to purge.  When we originally 
started using it (and our DB was 350Gb), database connections would timeout before some commands would finish.
 
Now, if others are using something different that has shown better results ... I'd love to know. 
--aj

A. J. Wright -- <ajw () utk edu>
Senior Security Analyst, Information Security Office
University of Tennessee, Knoxville

________________________________

From: snort-users-admin () lists sourceforge net on behalf of John Newman
Sent: Tue 2006-05-23 11:38 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] event database size



Anyone out there know of any good pre-existing solutions to keeping the
event database from growing ever bigger and bigger?  I suppose some
simple sql code, e.g.

delete from snort.event where time < 'XXXXX'

or something like that....  is this what others are doing?

--
John Newman
Systems Administrator, WebXess Inc.


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users