如何从 snort sql 中删除此事件？答案

【问题标题】：How to delete this event from snort sql?如何从 snort sql 中删除此事件？
【发布时间】：2017-06-02 04:25:14
【问题描述】：

我们如何从 snort sql 中删除这个事件？

我试过了：

在 Snort 机器上创建一个 sql 文件：nano dbclean.sql

将以下代码添加到sql文件中：

use snort;
DELETE FROM event WHERE timestamp < DATE_SUB(NOW(),INTERVAL 28 DAY);
DELETE FROM data    USING data    LEFT OUTER JOIN event USING (sid,cid) WHERE event.sid IS NULL;
DELETE FROM iphdr   USING iphdr   LEFT OUTER JOIN event USING (sid,cid) WHERE event.sid IS NULL;
DELETE FROM icmphdr USING icmphdr LEFT OUTER JOIN event USING (sid,cid) WHERE event.sid IS NULL;
DELETE FROM tcphdr  USING tcphdr  LEFT OUTER JOIN event USING (sid,cid) WHERE event.sid IS NULL;
DELETE FROM udphdr  USING udphdr  LEFT OUTER JOIN event USING (sid,cid) WHERE event.sid IS NULL;
DELETE FROM opt     USING opt     LEFT OUTER JOIN event USING (sid,cid) WHERE event.sid IS NULL;
DELETE FROM acid_event USING acid_event LEFT OUTER JOIN event USING (sid,cid) WHERE event.sid IS NULL;
DELETE FROM ag USING acid_ag_alert AS ag LEFT OUTER JOIN event AS e ON ag.ag_sid=e.sid AND ag.ag_cid=e.cid WHERE e.sid IS NULL;
OPTIMIZE TABLE event, data, iphdr, icmphdr, tcphdr, udphdr, opt, acid_event, acid_ag_alert;

下一步：

mysql -h YOUR-DB-HOST -uYOUR-DB-USER -pYOUR-DB-PASSWORD < dbclean.sql

但是没有用。请帮忙。

【问题讨论】：

标签： mysql sql snort

【解决方案1】：

您可以按照这种方式使用终端从数据库中删除所有记录：

DATABASE_NAME='snort';DBUSER='YourUser'; DBPASSWORD='YourPassword' ; mysql -Nse 'show tables' -D $DATABASE_NAME -u$DBUSER -p$DBPASSWORD | while read table; do echo "SET FOREIGN_KEY_CHECKS = 0;truncate table \`$table\`;SET FOREIGN_KEY_CHECKS = 1;"; done | mysql $DATABASE_NAME -u$DBUSER -p$DBPASSWORD

【讨论】：