Bug #305
Unable to delete huge amount of heartbeats with single preludedb-admin query
Start date:
Due date:
% Done:
0%
Resolution:
duplicate
Description
By now my db contains ~870K heartbeat events. I was supposed to clean up db every our by running in crontab the following script:
15 * * * * preludedb-admin delete heartbeat --criteria "heartbeat.create_time < @date '+%Y-%m-%d' -d '1 week ago'@" "type=mysql name=prelude user=prelude pass=xxx"
Unfortunately, when I set up more than 200+ sensors they began to submit a lot of heartbeats so the script silently ends. Running it manually I've got the following error:
retrieving alert ident failed: Got a packet bigger than 'max_allowed_packet' bytes. Error at transaction 0. Use --offset 0 to resume operation.
I was able to clean up database by adding --count=100000 option to line above and running it several times.
Associated revisions
History
#1 Updated by Yoann VANDOORSELAERE almost 15 years ago
- Status changed from New to Closed
- Resolution set to duplicate
This is a duplicate of #220.
#2 Updated by Yoann VANDOORSELAERE almost 15 years ago
#3 Updated by Yoann VANDOORSELAERE about 14 years ago
- Project changed from PRELUDE SIEM to LibpreludeDB
- Category deleted (
2) - Target version deleted (
0.9.15)