[Snort-users] Archiving events via BASE

David Ryan David.Ryan at ...13912...
Mon Jul 16 09:59:52 EDT 2007


Thanks for the reply.  I changed the setting you indicated below and the data archiving went correctly.  It just seemed a bit strange that snort or the back end didn't fail with any kind of error message to indicate that everything had not gone to plan.  I was still stuck with the single entry that I couldn't archive off (no matter what way I tried to archive it I just couldn't get it to move) so I just deleted it in the end.

Thanks again,


On Fri, Jun 22, 2007 at 03:23:05AM -0700, David Ryan wrote:

> There seems to be a problem with the archiving function, but I don't

> know if I am using it incorrectly.  I had one particular alert with

> 15,000+ events, so I went in to the view of unique alerts, selected

> the relevant icon on the list and selected 'archive (move) selected'

> from the actions.

> After a long time the transaction seemed to finish OK, but when I went

> in to look at it again there was still some large number of these

> events . . . maybe 5,000+.

> I checked the archive database and many of the entries had been moved.

> I repeated the procedure and it came down to 1,000+ events.  Then I

> repeated it and it left 1.

> No matter how many times I repeat, this 1 event will not move.


> So, here's the question - how come when I asked BASE to move all the

> records of a particular type it only moved part of them, and how come

> it refuses to move the last transaction ?

> It makes me a bit wary of the archive funtion if it has this type of

> issue.


php knows a timeout for each script. BASE increases this timeout a little bit, but not enough for such a huge number of alerts.

In base_conf.php look for a line like

        $max_script_runtime = 180;

Set this to 6000 or whatever:

        $max_script_runtime = 6000;

Bye, bye,


**********************  IMPORTANT--PLEASE READ  ************************
This electronic message, including its attachments, is COMPANY CONFIDENTIAL
and may contain PROPRIETARY or LEGALLY PRIVILEGED information.  If you are 
not the intended recipient, you are hereby notified that any use, disclosure,
copying, or distribution of this message or any of the information included
in it is unauthorized and strictly prohibited.  If you have received this
message in error, please immediately notify the sender by reply e-mail and
permanently delete this message and its attachments, along with any copies
thereof. If this electronic message contains a zipped attachment and you do
not have a decompression tool, you may download unZIP (free of cost) from:
http://www.mk-net-work.com/us/uz/unzip.htm. Alternatively, you may request
that the attachment be resent in an uncompressed format.        Thank you. 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070716/2890a5b4/attachment.html>

More information about the Snort-users mailing list