Re: [Prelude Hybrid IDS] #265: change assessment.impact.description forn VARCHAR(255) to TEXT in the database

#265: change assessment.impact.description forn VARCHAR(255) to TEXT in the
database
---------------------------------+------------------------------------------
 Reporter:  [email protected]  |        Owner:  yoann              
     Type:  enhancement          |       Status:  assigned           
 Priority:  normal               |    Milestone:  LibpreludeDB 0.9.14
Component:  libpreludedb         |      Version:  0.9                
 Severity:  normal               |   Resolution:                     
 Keywords:                       |  
---------------------------------+------------------------------------------
Comment (by yoann):

 Replying to [ticket:265 [email protected]]:
 > In libpreludedb I would Like to change the field in the database for
 assessment.impact.description to TEXT in the database this would
 effectivly unlimit the size of the field in PostgreSQL and SQLite, in
 MySQL it would set the maximum length to 65,535 characters. since this is
 not an indexed field and usauly not used for searching it should have a
 negligable if any proformance impact. It will also allow for much more
 verbose descriptions.

 Sound good, especially since some database engine forbid VARCHAR with more
 than 255 characters. This change is scheduled for the upcoming
 libpreludedb.

 MySQL:
 {{{
 ALTER TABLE Prelude_Impact CHANGE description description TEXT NULL;
 }}}

 PostgreSQL:
 {{{
 ALTER TABLE Prelude_Impact ALTER COLUMN description TYPE TEXT NULL;
 }}}


 > the reason why this came to my attention is im working on an snmp sensor
 it almost complete but i want to be able to add the description from the
 mib to the alert however i realized that many of the descriptions in the
 mibs excide 255 characters in addition many of them actualy excide 512
 characters. In RFC4765 there in the deffinition of a string there is no
 limit imposed on the length of a field.

 IDMEF does not impose length restriction on string, integer, or most other
 fields. However, we have to restrict fields length in the database layer
 for performance reasons.

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/265#comment:2>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel