Re: Archiving the archive

[Ken Gunderson <kgunders () teamcool net>]

On Thursday 13 February 2003 11:32 am, Bob Dehnhardt wrote:
> This might be somewhat off-topic, so send the penalty drinks my way
> (double them up, it's been one of those weeks).....
>
> I'm using Snort 1.9, Red Hat 7.3, ACID 0.9.23b, and MySQL 3.23.54. I
> process alerts from the snort db, and move the alerts to
> snort_archive when they've been checked out. The snort db stays very
> manageable, but I want to manage the archive a little better.
>
> I have a dream of splitting out my archive into separate databases,
> one per month, named something like "2002_10_snort_archive". This, I
> figure, will speed up the response time of archive searches, and let
> me easily move the old archives to CD-R when I don't need them on the
> server any more. Yeah, I know, ACID only accesses one database at a
> time, so this will make the archives harder to search. One mess at a
> time....
>
> In typical pointy-haired-manager style, I have this great (to my
> mind) idea, but not the slightest idea of how to implement it. I
> started reading through the MySQL docs, and got as far as
>
> SELECT t1.cid, t1.sid FROM acid_event AS t1 WHEN left(t1.timestamp,7)
> = '2002-10';
>
> and then I got completely stuck. This gave me a list of cids and sids
> from last October, just like I wanted, which I figure I need to use
> as an index to select the rest of the data for extraction. But HOW do
> I use that to extract the rest of the data, and insert it into a new
> database? Can anyone point me in the right direction?
>
> Thanks.
>
>  - Bob

try something like this.  adjust mysqldump flags to taste:

# mysqladmin create 2002_10_snort_archive

# mysqldump --opt existing_snort_archive | mysql --compress \ 
2002_10_snort_archive

this assumes your archiving to same localhost.  if not then need to add 
-h flag after compress and specify host where archive db is going to 
live.  i am assuming root, so you don't need to config access controls 
to do the dump.  but then you would want to for acid_browser. 

-- 
Best regards,

Ken Gunderson
PGP Key-- 9F5179FD

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.


-------------------------------------------------------
This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your  SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users