Rebuild event database from filesystem?
Posted: Tue Oct 01, 2013 9:50 pm
Hello to all and thanks for a great open source product.
I have a question about rebuilding my event database from the events stored on the filesystem.
I put my events directory on a CIFS share mounted from my NAS. This mostly works well.
However, I had a problem that every time the NAS went offline for some reason, if zmaudit.pl ran, it would delete all the events from the database. The events themselves are still on the disk -- I have about 2 GB of events sitting around and no access to them from the console.
I think I have fixed the problem by adding the "hard" option to the CIFS mount -- this should force zmaudit.pl to block rather than delete database entries when the NAS is temporarily offline. The default behavior for CIFS is "soft" in which any accesses to the filesystem will, when the filesystem is unavailable, return an error immediately, encouraging zmaudit.pl to delete the corresponding database entry.
Hopefully that will work fine. But now I have an empty database and want to rebuild my events database from the files that are still sitting there on the filesystem.
I guess I imagine a reverse of zmaudit.pl -- a script that looks for events on the disk and adds a database entry for any event that's on the FS but not in the DB.
Is it possible? I don't know if all the necessary information is there on the disk or not, but such a script would be very useful.
I have a question about rebuilding my event database from the events stored on the filesystem.
I put my events directory on a CIFS share mounted from my NAS. This mostly works well.
However, I had a problem that every time the NAS went offline for some reason, if zmaudit.pl ran, it would delete all the events from the database. The events themselves are still on the disk -- I have about 2 GB of events sitting around and no access to them from the console.
I think I have fixed the problem by adding the "hard" option to the CIFS mount -- this should force zmaudit.pl to block rather than delete database entries when the NAS is temporarily offline. The default behavior for CIFS is "soft" in which any accesses to the filesystem will, when the filesystem is unavailable, return an error immediately, encouraging zmaudit.pl to delete the corresponding database entry.
Hopefully that will work fine. But now I have an empty database and want to rebuild my events database from the files that are still sitting there on the filesystem.
I guess I imagine a reverse of zmaudit.pl -- a script that looks for events on the disk and adds a database entry for any event that's on the FS but not in the DB.
Is it possible? I don't know if all the necessary information is there on the disk or not, but such a script would be very useful.