[Snort-users] Mysql problem

Imran William Smith iwsmith at ...487...
Sun Jun 23 18:33:02 EDT 2002


Messagedata.MYD is the mysql 'data' file (MYI is the index file).  The 'data' file in the
snort database schema contains the payloads (and probably should have
been called 'payload', not 'data').

One guess, is that you may have hit one of the upper limits for MySQL data size,
since it is usually the payload table that grows fastest.

One limit is the maximum number of rows per table, you can change this
within mysql (either at create table time, or alter table).  I can't remember
the exact parameter.  It's tied up with the idea of average row size.  So you
can get around this limit.

The other limit is that some OS's can't create a file > 4Gb (2^32).  Others
can.  This is not a MySQL limitation, really.  But MySQL 3.x can't make a database
table spread over a number of files.  Not sure whether 4.x can.

Good luck

--
Imran William Smith
Security Products Development
Mimos Bhd, Malaysia



  ----- Original Message ----- 
  From: Steve Moran 
  To: snort-users at lists.sourceforge.net 
  Sent: Thursday, June 20, 2002 10:14 PM
  Subject: [Snort-users] Mysql problem


  I have some rules set up to monitor surfing, which generate a ton of alerts.  Like 70,000 alerts a day.  The problem is, when I try to delete, archive, or anything other than view some of the alerts when I have that many I get a 'Database ERROR:Database ERROR:Can't open file: 'data.MYD'. (errno: 145)'
   
  Anyone else see this with large #'s of alerts?  Or have any idea how to fix it.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020623/386fa7a9/attachment.html>


More information about the Snort-users mailing list