MHN - Delete Old Records

You can delete the fake attacks from MHN by using the mongo DB command.  Here is how you would do it for IP 1.2.3.4:

mongo mnemosyne
> db.session.count({ source_ip:"1.2.3.4" })
> db.session.remove({ source_ip:"1.2.3.4" })

The first command will show you how many entries will be deleted.  The 2nd command will delete them.

Depending on the setup, mongo may store the results with "::ffff:" prepended to the IP. So you may need to do this too:

> db.session.count({ source_ip:"::ffff:1.2.3.4" })
> db.session.remove({ source_ip:"::ffff:1.2.3.4" })
To explore the "logs" you can also use mongo.  Here is an example:

> db.session.find({source_ip: "4.5.5.6"})

---
I had issues connecting mongo to mnemosyne

gedit /etc/mongod.conf

change to

bind_ip = 0.0.0.0 


Then

sudo rm /var/lib/mongodb/mongod.lock
sudo service mongodb restart

--

Thanks

Jason Trost from ThreatStream

http://stackoverflow.com/questions/24899849/connection-refused-to-mongodb-errno-111