Does anyone have a solution for moving events from BASE to the BASE archive.
I currently have events going into the db I have setup for snort and ossec, when I try to move ossec events to the archive database I get the following error message: Archive error:Database ERROR:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Host-based anomaly detection event (rootcheck).' Src IP: (0.0.0.0) User: (none) ' at line 1 INSERT INTO data (sid,cid, data_payload) VALUES (40, 67653, '** Alert 1254234795.65673781: mail - ossec,rootcheck, 2009 Sep 29 10:33:15 webtest -> rootcheck Rule: 510 (level 7) -> 'Host-based anomaly detection event (rootcheck).' Src IP: (0.0.0.0) User: (none) File '/ var/log/acpid' is owned by root and has written permissions to anyone.') /var/www/html/base/includes/base_action.inc.php:1667: Archive error:: Not everything seems to have been written to the archive db: $sql_cnt = 3 $archive_cnt = 2 Ignored 1 duplicate alert(s) No alerts were selected or the Archive alert(s) (move) was not successful The primary database is snort, the archive being snort_archive, both have the exact same structure.
