<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Inliniac &#187; mysql</title>
	<atom:link href="http://www.inliniac.net/blog/tag/mysql/feed" rel="self" type="application/rss+xml" />
	<link>http://www.inliniac.net/blog</link>
	<description>Everything inline.</description>
	<lastBuildDate>Wed, 11 Jan 2012 19:09:17 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Deactivating a group of sensors in Sguil 0.7.0-CVS</title>
		<link>http://www.inliniac.net/blog/2007/11/14/deactivating-a-group-of-sensors-in-sguil-070-cvs.html</link>
		<comments>http://www.inliniac.net/blog/2007/11/14/deactivating-a-group-of-sensors-in-sguil-070-cvs.html#comments</comments>
		<pubDate>Wed, 14 Nov 2007 20:25:20 +0000</pubDate>
		<dc:creator>Victor Julien</dc:creator>
				<category><![CDATA[Sguil]]></category>
		<category><![CDATA[mysql]]></category>

		<guid isPermaLink="false">http://www.inliniac.net/blog/2007/11/14/deactivating-a-group-of-sensors-in-sguil-070-cvs.html</guid>
		<description><![CDATA[Recently a site I was using for my Vuurmuur project became unavailable to me. I had two sensors in that site, one Modsec2sguil sensor and a Snort sensor. Since it became unavailable to me, the sensors were all offline and will stay that way. So I wanted to hide them in Sguil, including the net_name [...]]]></description>
			<content:encoded><![CDATA[<p>Recently a site I was using for my Vuurmuur project became unavailable to me. I had two sensors in that site, one Modsec2sguil sensor and a Snort sensor. Since it became unavailable to me, the sensors were all offline and will stay that way. So I wanted to hide them in Sguil, including the net_name group they belonged to, called &#8216;utrecht&#8217;.</p>
<p>Doing this turned out to be quite simple. The sensors have their own table in the database and one of the fields for a sensor is called &#8216;active&#8217;. I figured deactivating the sensors would do it. Deactivating all sensors from the net_name group &#8216;utrecht&#8217; is done like this:</p>
<blockquote><p>mysql&gt; UPDATE sensor SET active=&#8221;N&#8221; WHERE net_name=&#8221;utrecht&#8221;;</p></blockquote>
<p>After this, the net_name &#8216;utrecht&#8217; disappeared from the Sguil client &#8216;Select Network(s) to Monitor&#8217; screen. However, the &#8216;Agent Status&#8217; tab in the Sguil client still showed the deactivated agents. This was solved by restarting the Sguil server. So now my &#8216;Agent Status&#8217; list is clean again!</p>
]]></content:encoded>
			<wfw:commentRss>http://www.inliniac.net/blog/2007/11/14/deactivating-a-group-of-sensors-in-sguil-070-cvs.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

