Manual Policy Building - Recent Incidents - signatures what is recent?

(Correcting an earlier post that mentioned purge_mysql_logs.pl which actually is for the MySQL binary logs.)

 

 

There is a clean_db.pl script that seems to remove the older entries, "older" being not very deterministically defined though.

 

 

For what I currently need, I have a script that queries the database and adds the signatures that have fired to a file. I run that script every hour through cron.hourly. Omitting the db login code that you can extract from the asmqkview script:

 

 

-----

 

 

OPTIONS=--skip-column-names

 

for POLICY in \'p1\' \'p2' \'p3\' ; do

 

echo `date` $POLICY

 

(mysql --user=root --password=$MYSQL_PASSWORD $OPTIONS PLC <

 

 

set @account = (select account_id from DCC.ACCOUNTS where active_policy_name = $POLICY);

 

 

select NEGSIG_SIGNATURES.sig_id, ":::", sig_name

 

from NEGSIG_SIGNATURES, LRN_NEGSIG_SIGNATURES

 

where account_id = @account

 

and NEGSIG_SIGNATURES.sig_id = LRN_NEGSIG_SIGNATURES.sig_id;

 

 

HERE

 

) | sort | uniq -c | sort -n

 

done >> /tmp/learned-signatures.log

 

 

-----

 

 

(I'll try to move the sorting and counting to the SQL query later.)

 

 

Arthur