Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help 
Prelude(1)			  User Commands 		      Prelude(1)

NAME
     preludedb-admin  -  tool  to  copy, move, delete, save or restore a prelude
     database

SYNOPSIS
     preludedb-admin copy|count|delete|load|move|optimize|save|update arguments

DESCRIPTION
     preludedb-admin can be used to copy, move, delete, save, update or  restore
     a Prelude database, partly or in whole, while preserving IDMEF data consis-
     tency.

     Mandatory arguments

     copy   Make a copy of a Prelude database to another database.

     count  Count the number of events in a Prelude database.

     delete
	    Delete content of a Prelude database.

     load   Load a Prelude database from a file.

     move   Move content of a Prelude database to another database.

     optimize
	    Optimize a Prelude database by deleting orphaned data.

     save   Save a Prelude database to a file.

     update
	    Update data in a Prelude database.

     Running a command without providing arguments will display a detailed help.

EXAMPLES
     Obtaining help on a specific command:

	    # preludedb-admin save
	    Usage  : save <alert|heartbeat> <database> <filename> [options]
	    Example: preludedb-admin save alert "type=mysql name=dbname user=prelude" outputfile

	    Save messages from <database> into [filename].
	    If no filename argument is provided, data will be written to standard output.

	    Database arguments:
	      type  : Type of database (mysql/pgsql).
	      name  : Name of the database.
	      user  : User to access the database.
	      pass  : Password to access the database.

	    Valid options:
	      --offset <offset> 	      : Skip processing until 'offset' events.
	      --count <count>		      : Process at most count events.
	      --query-logging [filename]      : Log SQL query to the specified file.
	      --criteria <criteria>	      : Only process events matching criteria.
	      --events-per-transaction	      : Maximum number of event to process per transaction (default 1000).

     Preludedb-admin can be useful to delete events from a prelude database :

	    preludedb-admin delete alert --criteria <criteria> "type=<mysql> name=<dbname> user=<prelude-user> pass=<pass>"

     where criteria is an IDMEF criteria :

	    preludedb-admin delete alert --criteria "alert.classification.text == 'UDP packet dropped'" "type=mysql name=prelude user=prelude-user pass=prelude-pass"

     This  will  delete  all  event  with  the	classification	text "UDP packet
     dropped" from the database.

SEE ALSO
     The    Prelude	Handbook:     https://www.prelude-siem.org/projects/pre-
     lude/wiki/ManualUser

     Prelude homepage: http://www.prelude-siem.com/

     Creating	  filter     using    IDMEF    Criteria:    https://www.prelude-
     siem.org/projects/prelude/wiki/IDMEFCriteria

     Prelude IDMEF Path:  https://www.prelude-siem.org/projects/prelude/wiki/ID-
     MEFPath

BUGS
     To report a bug, please visit https://www.prelude-siem.org/

AUTHOR
     This manpage was Written by Pierre Chifflier.

COPYRIGHT
     Copyright (C) 2006-2020 CS GROUP - France.
     This  is  free software.  You may redistribute copies of it under the terms
     of the GNU General Public	License  <http://www.gnu.org/licenses/gpl.html>.
     There is NO WARRANTY, to the extent permitted by law.

preludedb-admin 		    June 2012			      Prelude(1)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=preludedb-admin&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>

home | help