Re: [sentinix-list] Clearing Snort Database (revisited)
Michel Blomgren <[email protected]>
| Newsgroups | gmane.linux.sentinix |
|---|---|
| Message-ID | <[email protected]> |
On Monday 22 December 2003 16:30, M. Morgan wrote: > Hello all, > I'm trying to clear *all* of the alerts in the database and start from > scratch. If I use the method discussed last week on the list and go to > snort_center/alerts/delete alerts/ selected, "all on screen or entire > query" it will only delete the 50 alerts visable on the screen. There are > currently 400,000+ in the database I need to clear. > > Is there a method in snort center to clear "all" of the alerts in one fell > swoop? Yes! "all on screen" will only delete those visible on the screen, but "entire queue" will delete those based on what you have selected. If you choose to browse all alerts, then everything will be deleted, plain and simple. However, 400k alerts will probably take some time, make sure Snort is stopped first! You can recreate the SnortCenter and Snort database though, but you'll need to feed some MySQL queries for this. Now, I unfortunatly don't have time to pull that up, but checkout the SnortCenter and Snort docs (for snortcenter search google.com). > > If not, can someone give me the path to the mysql database files so I can > empty them by hand? I have been unsuccessfull in locating them thus far... You don't actually delete files when using MySQL, you use the proper tools, like a client, "mysql" or "mysqladmin". > > Ive looked in: > /var/lib/mysql# > > and found: > [email protected]:/var/lib/mysql# ls -al > total 20592 > drwxr-x--- 8 mysql mysql 4096 Dec 19 16:51 . > drwxr-xr-x 6 root root 4096 Dec 15 04:52 .. > -rw-rw---- 1 mysql root 1007 Dec 19 16:51 Underdog.err > -rw-rw---- 1 mysql mysql 3 Dec 19 16:51 Underdog.pid > drwx------ 2 mysql mysql 4096 Dec 15 04:52 cacti > -rw-rw---- 1 mysql mysql 25088 Nov 23 11:50 > ib_arch_log_0000000000 -rw-rw---- 1 mysql mysql 5242880 Dec 19 > 16:51 ib_logfile0 -rw-rw---- 1 mysql mysql 5242880 Nov 23 11:50 > ib_logfile1 -rw-rw---- 1 mysql mysql 10485760 Dec 15 15:49 ibdata1 > drwx------ 2 mysql mysql 4096 Dec 15 04:52 mysql > -rw-rw---- 1 mysql root 1205 Nov 23 11:52 sandbox.err > drwx------ 2 mysql mysql 4096 Dec 15 04:52 snort > drwx------ 2 mysql mysql 4096 Dec 15 04:52 snort_archive > drwx------ 2 mysql mysql 4096 Dec 15 04:52 snortcenter > drwx------ 2 mysql mysql 4096 Nov 23 11:50 test > > Many thanks. > > Michael > _______________________________________________ > SENTINIX mailing list > [email protected] > http://elevenprospect.com/mailman/listinfo/sentinix