-
Notifications
You must be signed in to change notification settings - Fork 3
Barnyard2 Database differences
If you are creating a "new" database (no old data) the database schema is set to 108. If you are attempting to modify an existing database, you'll likely want to change the database schema version to 107 in Barnyard2-extra source code. That line can be found at:
https://github.com/beave/barnyard2-extra/blob/master/src/output-plugins/spo_database.h#L521
In order for Barnyard2 to store Unified2 "Extra Data" an new table had to be created. That tables schema is as follows:
id INT AUTO_INCREMENT NOT NULL,
sid INT(10) NOT NULL,
cid INT(10) NOT NULL,
type INT(10) NOT NULL,
datatype INT(10) NOT NULL,
len INT(10) NOT NULL,
data MEDIUMTEXT NOT NULL,
PRIMARY KEY (id),
KEY
event (sid,cid));
This version of Barnyard2 also keys the sig_reference table slightly differently. This is in order to avoid the "duplicate key" issue we've seen when multiple sensors are attempting to update/add entries into the sig_reference . In this version of the schema, we key all values, like thus:
sig_id INT UNSIGNED NOT NULL,
ref_seq INT UNSIGNED NOT NULL,
ref_id INT UNSIGNED NOT NULL,
PRIMARY KEY(sig_id, ref_seq, ref_id));