[Snort-devel] Composite keys in Snort DB schema
Christian Robottom Reis
kiko at ...2474...
Mon Aug 23 09:16:02 EDT 2004
I've been taking a look at Snort's DB schema (using the recently
updated diagram Chris provided) and a question has popped up. Is there a
reason why we use a composite key (cid and sid) for the tables beyond
wanting to have sequential cids for each sensor? It seems it complicates
things somewhat since we need to spread out these keys over all the
tables in the event-specific snort tables.
Wouldn't it be simpler -- white still fully functional -- to have a
single globally unique sequential event ID?
Christian Robottom Reis | http://async.com.br/~kiko/ | [+55 16] 3361 2331
More information about the Snort-devel