reporter: Fix cleanup job

Since SQLite3 does not automatically parse any timestamps, usually all
events were dropped because of an inconsistent comparison.

This patch will now convert the timestamp into float, so it can be
better compared to the timestamp which is stored as a REAL.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/suricata-reporter.in b/src/suricata-reporter.in
index c90c1ef13ca7519d8cd32cebda600dd82155b239..e1c25b48b49f7c6818aadfc8ad80439f5c35230b 100644 (file)
--- a/src/suricata-reporter.in
+++ b/src/suricata-reporter.in
@@ -381,10 +381,12 @@ class Worker(threading.Thread):
                                # Save when we performed this last
                                self.reporter.last_cleanup_at = now
 
+                               # Determine the timestamp as float
+                               t = (now - retention_days).timestamp()
+
                                # Remove everything
                                self.db.execute(
-                                       "DELETE FROM alerts WHERE timestamp <= ?",
-                                       (now - retention_days,),
+                                       "DELETE FROM alerts WHERE timestamp <= ?", (t,),
                                )
 
                        # Release the lock