[ossec-list] Re: OSSEC -> BASE -> Archive

[sec0ps]

I`m guessing this is the section causing the issue. I am by no means
an SQL person..does someone have a recommended fix for this portion of
the code to resolve the archiving issue?

      /* If we have FLoP extended db `pcap_header` or `data_header`
then archive it too. */
      if ( ($pcap_header!="") || ($data_header!="") ) {
         $sql = "INSERT INTO data (sid,cid, data_payload, pcap_header,
data_header) VALUES ";
         $sql.= "($sid, $cid, '".$tmp_row[0]."', '".$pcap_header."',
'".$data_header."')";
      } else {
         $sql = "INSERT INTO data (sid,cid, data_payload) VALUES ";
         $sql.= "($sid, $cid, '".$tmp_row[0]."')";
      }

      $insert_sql[$sql_cnt++] = $sql;
   }
   /************** xxx jl: </flop specific tables>
********************/