Prelude(1)

📦 version 5.2.0, in debian bookworm, epel 9, ubuntu jammy, ubuntu noble

👑 Prelude(1) — the preludedb-admin page, bestie edition ✨

okay so. you found yourself in section 1 of the Prelude manual, staring at preludedb-admin, and you're like "what is this and why is it lowkey iconic?" bestie. sit down. I got you. 💖

🎀 NAME

preludedb-admin — the tool to copy, move, delete, save or restore a prelude database 💅

🌸 SYNOPSIS

preludedb-admin copy|count|delete|load|move|optimize|save|update
arguments

that's it. that's the whole vibe. pick a command, hand it some arguments, go. ✨

🦋 DESCRIPTION

preludedb-admin can be used to copy, move, delete, save, update or restore a Prelude database, partly or in whole, while preserving IDMEF data consistency. no cap, that consistency part is the whole point — it's not out here just yeeting your rows around.

💜 Mandatory arguments

these are not optional, bestie. you HAVE to pick one. fr fr.

  • copy — Make a copy of a Prelude database to another database. 🫶
  • count — Count the number of events in a Prelude database. literally just counting. math girl summer.
  • delete — Delete content of a Prelude database. 💀
  • load — Load a Prelude database from a file.
  • move — Move content of a Prelude database to another database.
  • optimize — Optimize a Prelude database by deleting orphaned data. it's giving spring cleaning 🧹
  • save — Save a Prelude database to a file.
  • update — Update data in a Prelude database.
🫶 pro tip from the manpage itself: Running a command without providing arguments will display a detailed help. so if you're lost, just run it with nothing and let it talk to you.

🌈 EXAMPLES

✨ getting help on one specific command

look at her go:

# preludedb-admin save
Usage  : save <alert|heartbeat> <database> <filename> [options]
Example: preludedb-admin save alert "type=mysql name=dbname user=prelude" outputfile

Save messages from <database> into [filename].
If no filename argument is provided, data will be written to standard output.

Database arguments:
  type  : Type of database (mysql/pgsql).
  name  : Name of the database.
  user  : User to access the database.
  pass  : Password to access the database.

Valid options:
  --offset <offset>               : Skip processing until 'offset' events.
  --count <count>                 : Process at most count events.
  --query-logging [filename]      : Log SQL query to the specified file.
  --criteria <criteria>           : Only process events matching criteria.
  --events-per-transaction        : Maximum number of event to process per transaction (default 1000).

see how it spills all the tea when you just ask? iconic behaviour. and yes — no filename argument means it writes to standard output, so it'll just come straight at you. 👑

🍓 deleting events from a prelude database

preludedb-admin can be useful to delete events from a prelude database, like so:

preludedb-admin delete alert --criteria <criteria> "type=<mysql> name=<dbname> user=<prelude-user> pass=<pass>"

where criteria is an IDMEF criteria:

preludedb-admin delete alert --criteria "alert.classification.text == 'UDP packet dropped'" "type=mysql name=prelude user=prelude-user pass=prelude-pass"

This will delete all event with the classification text "UDP packet dropped" from the database. bye girl, we won't miss you 🙈

💜 SEE ALSO

go read these, they're the syllabus:

💀 BUGS

To report a bug, please visit https://www.prelude-siem.org/ — don't suffer in silence, bestie, tell the maintainers. 🫶

🌟 AUTHOR

This manpage was Written by Pierre Chifflier. thank you king 🎀

Copyright © 2006-2020 CS GROUP - France.

This is free software. You may redistribute copies of it under the terms of the GNU General Public License <http://www.gnu.org/licenses/gpl.html>. There is NO WARRANTY, to the extent permitted by law. (and yes the caps on NO WARRANTY are doing the heavy lifting there, it's serious 🚨)

and that's the whole page, bestie!! 💖✨ this one's preludedb-admin, dated June 2012, and it lives in the Prelude(1) manual — go forth and copy, move, delete, load, optimize, save and update responsibly. mwah 💅🦋🌸

📦 where this page comes from