[Snort-devel] Duplicate entries

Ian Macdonald secsnortdev at ...1490...
Fri Sep 13 12:00:05 EDT 2002


Found the notes in the change log for schema 106. I added the column as
suggested, but I am running into a problem with existing data.

The plugin should do a

select @MAX_CID := max(cid) from event where sid = XX;
update sensor set last_cid = @MAX_CID where sid =XX;

during startup to make sure that the max CID is correct in the sensor table
if you have existing data then in column starts off at 0 and you get a whole
load of errors

This is with a snapshot from today and mysql

Ian





More information about the Snort-devel mailing list