Unable to delete huge amount of heartbeats with single preludedb-admin query
By now my db contains ~870K heartbeat events. I was supposed to clean up db every our by running in crontab the following script:
15 * * * * preludedb-admin delete heartbeat --criteria "heartbeat.create_time < @date '+%Y-%m-%d' -d '1 week ago'@" "type=mysql name=prelude user=prelude pass=xxx"
Unfortunately, when I set up more than 200+ sensors they began to submit a lot of heartbeats so the script silently ends. Running it manually I've got the following error:
retrieving alert ident failed: Got a packet bigger than 'max_allowed_packet' bytes. Error at transaction 0. Use --offset 0 to resume operation.
I was able to clean up database by adding --count=100000 option to line above and running it several times.