Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Snort-users] SQL to purge alerts over 1 month old?

from [Terry Burton] Network Security [Permanent Link]
Subject: Re: [Snort-users] SQL to purge alerts over 1 month old?
Date: Tue, 26 Feb 2008 10:44:29 +0000 
On Mon, Feb 4, 2008 at 2:14 PM, Michael W Cocke <cocke@catherders.com> wrote:

The subject line pretty much says it - I'm medium fair at SQL, but I'm
 not seeing this;  Anyone know the syntax to flush alerts older than
 one month from the alerts DB (MySQL if it matters)?


Hi Mike,

I've only just caught up with this thread. Archive plus looks very
useful and I might try it myself some time.

If you are looking for something a bit simpler then the following SQL
might be of interest:

http://www.terryburton.co.uk/blog/2007/09/deleting-old-snort-and-base-event-data.html

It purges the event table of old events, removes all of the entries
from referring tables that have been orphaned and finally optimises
the tables. It will leave things clean.

I have been successfully using this in a nightly cron job for about a year now.


Hope this helps,

Tez

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Snort-users] Strange portscan traffic with dest of 169.254.x.x, Joel Esler
Next by Date:  Re: [Snort-users] Strange portscan traffic with dest of 169.254.x.x, Aaron Giuoco
Previous by Thread:  Re: [Snort-users] SQL to purge alerts over 1 month old?, Paul Schmehl
Next by Thread:  [Snort-users] Snort Rules Availability, CoryC
Indexes:  [Date] [Thread] [Top] [All Lists]