[Snort-devel] Composite keys in Snort DB schema

Christian Robottom Reis kiko at ...2474...
Mon Aug 23 09:16:02 EDT 2004

Hello there,

    I've been taking a look at Snort's DB schema (using the recently
updated diagram Chris provided) and a question has popped up. Is there a
reason why we use a composite key (cid and sid) for the tables beyond
wanting to have sequential cids for each sensor? It seems it complicates
things somewhat since we need to spread out these keys over all the
tables in the event-specific snort tables. 

Wouldn't it be simpler -- white still fully functional -- to have a
single globally unique sequential event ID?

Take care,
Christian Robottom Reis | http://async.com.br/~kiko/ | [+55 16] 3361 2331

More information about the Snort-devel mailing list