Project

General

Profile

Feature #265

change assessment.impact.description forn VARCHAR(255) to TEXT in the database

Added by prmarino1-gmail-com - almost 12 years ago. Updated over 10 years ago.

Status:
Closed
Priority:
Normal
Target version:
Start date:
Due date:
% Done:

0%

Resolution:
fixed

Description

In libpreludedb I would Like to change the field in the database for assessment.impact.description to TEXT in the database this would effectivly unlimit the size of the field in [[PostgreSQL]] and SQLite, in [[MySQL]] it would set the maximum length to 65,535 characters. since this is not an indexed field and usauly not used for searching it should have a negligable if any proformance impact. It will also allow for much more verbose descriptions.
the reason why this came to my attention is im working on an snmp sensor it almost complete but i want to be able to add the description from the mib to the alert however i realized that many of the descriptions in the mibs excide 255 characters in addition many of them actualy excide 512 characters. In RFC4765 there in the deffinition of a string there is no limit imposed on the length of a field.

History

#1 Updated by Yoann VANDOORSELAERE almost 12 years ago

  • Status changed from New to Assigned

#2 Updated by Yoann VANDOORSELAERE almost 12 years ago

Replying to prmarino1@gmail.com:

In libpreludedb I would Like to change the field in the database for assessment.impact.description to TEXT in the database this would effectivly unlimit the size of the field in [[PostgreSQL]] and SQLite, in [[MySQL]] it would set the maximum length to 65,535 characters. since this is not an indexed field and usauly not used for searching it should have a negligable if any proformance impact. It will also allow for much more verbose descriptions.

Sound good, especially since some database engine forbid VARCHAR with more than 255 characters. This change is scheduled for the upcoming libpreludedb.

[[MySQL]]:

ALTER TABLE Prelude_Impact CHANGE description description TEXT NULL;

[[PostgreSQL]]:

ALTER TABLE Prelude_Impact ALTER COLUMN description TYPE TEXT NULL;

the reason why this came to my attention is im working on an snmp sensor it almost complete but i want to be able to add the description from the mib to the alert however i realized that many of the descriptions in the mibs excide 255 characters in addition many of them actualy excide 512 characters. In RFC4765 there in the deffinition of a string there is no limit imposed on the length of a field.

IDMEF does not impose length restriction on string, integer, or most other fields. However, we have to restrict fields length in the database layer for performance reasons.

#3 Updated by Yoann VANDOORSELAERE almost 12 years ago

  • Status changed from Assigned to Closed
  • Resolution set to fixed

(In r10025) Use TEXT in place of VARCHAR for alert.assessment.impact.description (fix #265).

#4 Updated by Yoann VANDOORSELAERE over 10 years ago

  • Project changed from PRELUDE SIEM to LibpreludeDB
  • Category deleted (2)
  • Target version deleted (0.9.14)

Also available in: Atom PDF