Snort mailing list archives

Find out your snort database size

From: "Lance Boon" <lboon () firststatebanksw com>
Date: Thu, 3 Jun 2004 11:50:27 -0500

Don't know if this would do anybody any good but I thought that I'd
share this with the list. I was always wondering about how big my snort
database was so I did a little research and came across something and
just customized it to use with snort. All you need to do is copy and
paste the code into a php file ex.. dbinfo.php then put it in your
htdocs directory.  If anybody has any improvements to this please feel
free to share. You could customize this to use with any mysql database
just by changing the db_server, db-users, db_pwd and db_name.

<html><head><title>SNORT Database Size</title></head><body>
<h1>SNORT Database Size</h1>
<?php
function file_size_info($filesize) {
 $bytes = array('KB', 'KB', 'MB', 'GB', 'TB'); # values are always
displayed
 if ($filesize < 1024) $filesize = 1; # in at least kilobytes.
 for ($i = 0; $filesize > 1024; $i++) $filesize /= 1024;
 $file_size_info['size'] = ceil($filesize);
 $file_size_info['type'] = $bytes[$i];
 return $file_size_info;
}
$db_server = 'localhost';
$db_user = 'user';
$db_pwd = 'password';
$db_name = 'snort';
$db_link = @mysql_connect($db_server, $db_user, $db_pwd)
 or exit('Could not connect: ' . mysql_error());
$db = @mysql_select_db($db_name, $db_link)
 or exit('Could not select database: ' . mysql_error());
// Calculate DB size by adding table size + index size:
$rows = mysql_query("SHOW TABLE STATUS");
$dbsize = 0;
while ($row = mysql_fetch_array($rows)) {
  $dbsize += $row['Data_length'] + $row['Index_length'];
  print '<pre>Table: <strong>' . $row['Name'] . '</strong><br />';
  print 'database size. . .: ' . $row['Data_length'] . '<br />';
  print 'Index size . . . .: ' . $row['Index_length'] . '<br />';
  print 'Total size . . . .: ' . ($row['Data_length'] +
$row['Index_length']) . '<br /></pre>';
 }
while ($row = mysql_fetch_array($rows)) {
 $dbsize += $row['Data_length'] + $row['Index_length'];
}
print "database size is: <strong> $dbsize </strong> bytes<br />";
print 'or<br />';
$dbsize = file_size_info($dbsize);
print "database size is: <strong> {$dbsize['size']} </strong>
{$dbsize['type']}";
?>
</body></html>



Webpage output would be as follows:

SNORT Database Size

Table: data
database size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: detaildatabase size. . .: 40
Index size . . . .: 2048
Total size . . . .: 2088

Table: encodingdatabase size. . .: 60
Index size . . . .: 2048
Total size . . . .: 2108

Table: eventdatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: flagsdatabase size. . .: 17476
Index size . . . .: 1024
Total size . . . .: 18500

Table: icmphdrdatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: iphdrdatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: optdatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: protocolsdatabase size. . .: 6248
Index size . . . .: 1024
Total size . . . .: 7272

Table: referencedatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: reference_systemdatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: schemadatabase size. . .: 13
Index size . . . .: 2048
Total size . . . .: 2061

Table: sensordatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: servicesdatabase size. . .: 3686536
Index size . . . .: 1024
Total size . . . .: 3687560

Table: sig_classdatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: sig_referencedatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: signaturedatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: tcphdrdatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

Table: udphdrdatabase size. . .: 0
Index size . . . .: 1024
Total size . . . .: 1024

database size is: 3732901 bytes
or
database size is: 4 MB


-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.

From Windows to Linux, servers to mobile, InstallShield X is the one

installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Current thread:

Find out your snort database size Lance Boon (Jun 03)