The network guys set up Snort with MySQL and ACID 100 days ago. They came last night and asked about a little problem - no disk space. I found that every day a 1Gb binary file that is in the sub-directory of MySQL where SNORT is updating the transactions. I dumped one just to see what is happening and it is a transaction log of the actions being updated to the "snort" database. I did not find any answers about these files being created but I am sure they are related to the snort.conf file option for this option:

output database: log, mysql, user=root password=mysql dbname=snort host=localhost

My immediate question is do I just delete the older versions (they increment starting at 1 and are at 113 now; e.g., my-host-bin.1...my-host-bin.113).

lsof shows that the current version (113) is open by mysql as is the my-host-bin.index file. These appear to be like a tranlog file that I could use to recover or replay the updates. I am not sure of their value, but I need to delete the older ones to get space back.

What is the best/correct way to do this (I have not found any answers yet at snort but I only got this crises last night and I have about 2 more days for a correct solution).

And are these binary files used for anything after they are created?

Thanks,

Richard