53 lines
1.4 KiB
SQL
53 lines
1.4 KiB
SQL
-- Read-only diagnostics for sizing and partition verification.
|
|
SET time_zone = '+00:00';
|
|
|
|
SELECT
|
|
TABLE_NAME,
|
|
ENGINE,
|
|
TABLE_ROWS,
|
|
ROUND(DATA_LENGTH / 1024 / 1024, 1) AS data_mb,
|
|
ROUND(INDEX_LENGTH / 1024 / 1024, 1) AS index_mb,
|
|
ROUND((DATA_LENGTH + INDEX_LENGTH) / 1024 / 1024, 1) AS total_mb
|
|
FROM information_schema.TABLES
|
|
WHERE TABLE_SCHEMA = DATABASE()
|
|
ORDER BY (DATA_LENGTH + INDEX_LENGTH) DESC;
|
|
|
|
SELECT
|
|
TABLE_NAME,
|
|
COUNT(*) AS partitions,
|
|
MIN(PARTITION_NAME) AS oldest_partition,
|
|
MAX(PARTITION_NAME) AS newest_partition,
|
|
ROUND(SUM(DATA_LENGTH + INDEX_LENGTH) / 1024 / 1024, 1) AS total_mb
|
|
FROM information_schema.PARTITIONS
|
|
WHERE TABLE_SCHEMA = DATABASE()
|
|
AND PARTITION_NAME IS NOT NULL
|
|
GROUP BY TABLE_NAME
|
|
ORDER BY total_mb DESC;
|
|
|
|
SELECT
|
|
channel_name,
|
|
event_id,
|
|
SUM(cnt) AS events_24h,
|
|
COUNT(*) AS metadata_rows_24h,
|
|
ROUND(SUM(cnt) / NULLIF(COUNT(*), 0), 2) AS compression_factor
|
|
FROM event_occurrences
|
|
WHERE bucket_start >= UTC_TIMESTAMP() - INTERVAL 24 HOUR
|
|
GROUP BY channel_name, event_id
|
|
ORDER BY events_24h DESC
|
|
LIMIT 50;
|
|
|
|
SELECT
|
|
first_event_ts,
|
|
last_event_ts,
|
|
cnt,
|
|
hostname,
|
|
target_user,
|
|
workstation,
|
|
src_ip
|
|
FROM event_occurrences
|
|
WHERE channel_name = 'Security'
|
|
AND event_id = 4740
|
|
AND bucket_start >= UTC_TIMESTAMP() - INTERVAL 7 DAY
|
|
ORDER BY bucket_start DESC
|
|
LIMIT 200;
|