[Snort-users] Snort, MySQL, Acid
Anton A. Chuvakin
anton at ...5376...
Mon May 6 12:34:06 EDT 2002
>I think the easiest way, since you have ACID, is to query on your IP
>address in ACID, and then tell it to delete the whole query. It will
>clean up nicely.
Not it if you have 100,000 records or more.
Sorry for a one-liner, but archiving/deleting with ACID for large
databases is very unstable. I have not found a way to recover my
ACID/snort database after it was flooded by thousands of records. That
leaves in pretty much unusable shape.
Anton A. Chuvakin, Ph.D.
More information about the Snort-users