search

Snorby / snorby

Ruby On Rails Application For Network Security Monitoring
Other
1k stars 226 forks source link

Incomplete DB pruning #354

Open adepasquale opened 10 years ago

adepasquale commented 10 years ago

I'm not sure whether this is a known issue or not, but I have problems with Snorby's DB pruning feature.

I've set DB pruning to 500.000 events but only the event table seems to be pruned. Is this the expected behaviour? I had to manually run

delete from data where (sid, cid) not in (select sid, cid from event);
optimize table data;

The same for other tables (iphdr, icmphdr, etc...)

adepasquale commented 9 years ago

Are both of these right places to insert the aforementioned pruning functionalities?

adepasquale commented 9 years ago

Or would it be better to handle this on the DB with ON DELETE CASCADE?

Or maybe here? https://github.com/Snorby/snorby/blob/master/app/models/event.rb#L85-L89