Re: [Prelude Hybrid IDS] #305: Unable to delete huge amount of heartbeats with single preludedb-admin query

#305: Unable to delete huge amount of heartbeats with single preludedb-admin
query
--------------------------+-------------------------------------------------
 Reporter:  Shurcik       |        Owner:                     
     Type:  defect        |       Status:  closed             
 Priority:  normal        |    Milestone:  LibpreludeDB 0.9.15
Component:  libpreludedb  |      Version:  0.9                
 Severity:  normal        |   Resolution:  duplicate          
 Keywords:                |  
--------------------------+-------------------------------------------------
Changes (by yoann):

  * status:  new => closed
  * resolution:  => duplicate
  * milestone:  => LibpreludeDB 0.9.15


Old description:

> By now my db contains ~870K heartbeat events. I was supposed to clean up
> db every our by running in crontab the following script:
>
> 15 * * * * preludedb-admin delete heartbeat --criteria
> "heartbeat.create_time < `date '+%Y-%m-%d' -d '1 week ago'`" "type=mysql
> name=prelude user=prelude pass=xxx"
>
> Unfortunately, when I set up more than 200+ sensors they began to submit
> a lot of heartbeats so the script silently ends. Running it manually I've
> got the following error:
>
> retrieving alert ident failed: Got a packet bigger than
> 'max_allowed_packet' bytes.
> Error at transaction 0. Use --offset 0 to resume operation.
>
> I was able to clean up database by adding --count=100000 option to line
> above and running it several times.

New description:

 By now my db contains ~870K heartbeat events. I was supposed to clean up
 db every our by running in crontab the following script:

 {{{
 15 * * * * preludedb-admin delete heartbeat --criteria
 "heartbeat.create_time < `date '+%Y-%m-%d' -d '1 week ago'`" "type=mysql
 name=prelude user=prelude pass=xxx"
 }}}

 Unfortunately, when I set up more than 200+ sensors they began to submit a
 lot of heartbeats so the script silently ends. Running it manually I've
 got the following error:

 {{{
 retrieving alert ident failed: Got a packet bigger than
 'max_allowed_packet' bytes.
 Error at transaction 0. Use --offset 0 to resume operation.
 }}}

 I was able to clean up database by adding --count=100000 option to line
 above and running it several times.

--

Comment:

 This is a duplicate of #220.

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/305#comment:1>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel