Suricata flow_id overflows MySQL INT

bammv / sguil

Sguil client for NSM

GNU General Public License v3.0

213 stars 74 forks source link

Suricata flow_id overflows MySQL INT #59

Open cherdt opened 4 years ago

cherdt commented 4 years ago

Suricata's flow_id is now a 64-bit unsigned integer, which causes an error when using the suricata_agent.tcl script due to the size of the unified_event_id and unified_event_ref columns in the MySQL database.

In my tests, changing those fields from INT to BIGINT fixed the problem although existing database tables would need to be modified or deleted/recreated.

q2dg commented 3 years ago

It seems this project is abandoned, sadly