• Support
  • Forums
  • Blogs

Clearing Data from Database Table alienvault_siem.extra_data

vsolemvsolem

Big Time
+6
While having some issues with performance and the nightly backup (which was taking more than 24 hours to delete data from the database), I may have manually deleted some rows from the table alienvault_siem.acid_event.

I'm getting ready to restart the flow of data into OSSIM, but I noticed that in the table alienvault_siem.extra_data there are more than 170,000 rows which do not refer to an ID in the table alienvault_siem.acid_event.

Is it safe to delete these rows?

Are there other tables that should be cleaned up as well?

I'm considering a sql statement like this.
delete from alienvault_siem.extra_data where event_id not in (select id from alienvault_siem.acid_event);

Following is the supporting data.
Current database: alienvault

+----------+
| count(*) |
+----------+
|   171832 |
+----------+
1 row in set (0.44 sec)

mysql> select count(*) from alienvault_siem.extra_data;
+----------+
| count(*) |
+----------+
|   172109 |
+----------+
1 row in set (0.00 sec)

mysql> select count(*) from alienvault_siem.extra_data where event_id in (select id from alienvault_siem.acid_event);
+----------+
| count(*) |
+----------+
|      277 |
+----------+
1 row in set (0.00 sec)

mysql> select count(*) from alienvault_siem.acid_event;
+----------+
| count(*) |
+----------+
|      277 |
+----------+
1 row in set (0.00 sec)

mysql> select count(*) from alienvault_siem.extra_data where event_id not in (select id from alienvault_siem.acid_event);
+----------+
| count(*) |
+----------+
|   171832 |
+----------+
1 row in set (0.00 sec)

mysql>
Tagged:

Share post:

This discussion has been closed.