[Prelude Hybrid IDS] #305: Unable to delete huge amount of heartbeats with single preludedb-admin query

#305: Unable to delete huge amount of heartbeats with single preludedb-admin
query
---------------------+------------------------------------------------------
 Reporter:  Shurcik  |        Type:  defect      
   Status:  new      |    Priority:  normal      
Milestone:           |   Component:  libpreludedb
  Version:  0.9      |    Severity:  normal      
 Keywords:           |  
---------------------+------------------------------------------------------
 By now my db contains ~870K heartbeat events. I was supposed to clean up
 db every our by running in crontab the following script:

 15 * * * * preludedb-admin delete heartbeat --criteria
 "heartbeat.create_time < `date '+%Y-%m-%d' -d '1 week ago'`" "type=mysql
 name=prelude user=prelude pass=xxx"

 Unfortunately, when I set up more than 200+ sensors they began to submit a
 lot of heartbeats so the script silently ends. Running it manually I've
 got the following error:

 retrieving alert ident failed: Got a packet bigger than
 'max_allowed_packet' bytes.
 Error at transaction 0. Use --offset 0 to resume operation.

 I was able to clean up database by adding --count=100000 option to line
 above and running it several times.

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/305>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel