SELECT t6.name, CASE WHEN (t2.address IS NULL) THEN CASE WHEN t3.address IS NULL THEN 'n/a' ELSE '127.0.0.1' END WHEN (t2.address = ' ') THEN '127.0.0.1 ' ELSE t2.address END AS "Source Addr" , CASE WHEN t3.address IS NULL THEN (SELECT path FROM Prelude_File AS t8 LEFT JOIN Prelude_Alert AS top ON (t8._message_ident = top._ident) WHERE t8._parent0_index = -1 AND t8._index = -1) ELSE t3.address END AS "Target Addr" , MAX(top._ident) , MAX(t0.time) AS "LTS" FROM Prelude_Alert AS top LEFT JOIN Prelude_Address AS t2 ON ( top._ident = t2._message_ident AND t2._parent_type = 'S' AND t2._parent0_index = -1 AND t2._index = -1) LEFT JOIN Prelude_Address AS t3 ON ( top._ident = t3._message_ident AND t3._parent_type = 'T' AND t3._parent0_index = -1 AND t3._index = -1) LEFT JOIN Prelude_Classification AS t1 ON ( top._ident = t1._message_ident) LEFT JOIN Prelude_Analyzer AS t6 ON ( (t6.name = 'PAM') AND top._ident = t6._message_ident AND t6._parent_type = 'A' AND t6._index = -1) LEFT JOIN Prelude_CreateTime AS t0 ON ( t0._message_ident = top._ident AND t0._parent_type = 'A')
LEFT JOIN Prelude_Alert AS tlast ON ( t6.name = 'PAM' AND tlast._ident = top._ident) WHERE t0.time >= '2005-12-11 23:00:00.0' AND t0.time < '2005-12-24 23:00:00.0'
GROUP BY 1,2,3
EXCEPT
SELECT t6.name, CASE WHEN (t2.address IS NULL) THEN CASE WHEN t3.address IS NULL THEN 'n/a' ELSE '127.0.0.1' END WHEN (t2.address = ' ') THEN '127.0.0.1 ' ELSE t2.address END AS "Source Addr" , CASE WHEN t3.address IS NULL THEN (SELECT path FROM Prelude_File AS t8 LEFT JOIN Prelude_Alert AS top ON (t8._message_ident = top._ident) WHERE t8._parent0_index = -1 AND t8._index = -1) ELSE t3.address END AS "Target Addr" , MAX(top._ident) , MAX(t0.time) AS "LTS" FROM Prelude_Alert AS top LEFT JOIN Prelude_Address AS t2 ON ( top._ident = t2._message_ident AND t2._parent_type = 'S' AND t2._parent0_index = -1 AND t2._index = -1) LEFT JOIN Prelude_Address AS t3 ON ( top._ident = t3._message_ident AND t3._parent_type = 'T' AND t3._parent0_index = -1 AND t3._index = -1) LEFT JOIN Prelude_Classification AS t1 ON ( top._ident = t1._message_ident) LEFT JOIN Prelude_Analyzer AS t6 ON ( (t6.name IS NULL) AND top._ident = t6._message_ident AND t6._parent_type = 'A' AND t6._index = -1) LEFT JOIN Prelude_CreateTime AS t0 ON ( t0._message_ident = top._ident AND t0._parent_type = 'A')
LEFT JOIN Prelude_Alert AS tlast ON (tlast._ident is null and tlast._ident = top._ident) WHERE t0.time >= '2005-12-11 23:00:00.0' AND t0.time < '2005-12-24 23:00:00.0'
GROUP BY 1,2,3
ORDER BY 5 DESC
e-REdING. Biblioteca de la Escuela Superior de Ingenieros de Sevilla.
