2011-03-03 117 views
1

我在包裝我的大腦時遇到了麻煩。該數據是從3個表來(我已經去除了所有不必要的數據可讀性更強):Mysql:從多個連接表中選擇特定數據

mysql> describe vulnerability; 
+---------------+------------------+------+-----+---------+----------------+ 
| Field   | Type    | Null | Key | Default | Extra   | 
+---------------+------------------+------+-----+---------+----------------+ 
| vuln_id  | int(10) unsigned | NO | PRI | NULL | auto_increment | 
| severity  | int(10) unsigned | NO |  | NULL |    | 
| host_id  | int(10) unsigned | NO | MUL | NULL |    | 
+---------------+------------------+------+-----+---------+----------------+ 

mysql> describe cve; 
+---------+------------------+------+-----+---------+----------------+ 
| Field | Type    | Null | Key | Default | Extra   | 
+---------+------------------+------+-----+---------+----------------+ 
| cve_id | int(10) unsigned | NO | PRI | NULL | auto_increment | 
| cve  | varchar(15)  | NO |  | NULL |    | 
| vuln_id | int(10) unsigned | NO | MUL | NULL |    | 
| year | int(4) unsigned | YES |  | NULL |    | 
+---------+------------------+------+-----+---------+----------------+ 

mysql> describe host; 
+--------------+------------------+------+-----+---------+----------------+ 
| Field  | Type    | Null | Key | Default | Extra   | 
+--------------+------------------+------+-----+---------+----------------+ 
| host_id  | int(10) unsigned | NO | PRI | NULL | auto_increment | 
| ip_addr  | int(10) unsigned | NO |  | NULL |    | 
+--------------+------------------+------+-----+---------+----------------+ 

我想輸出小於2009年與嚴重程度是由於有漏洞的主機數量= 3 。年份包含在CVE中,該漏洞與vuln_id FK綁定在一起。該漏洞具有嚴重性,並與host_id FK綁定在一起。這是我到目前爲止:

mysql> select count(distinct ip_addr) from host H 
    inner join vulnerability V on H.host_id = V.host_id 
    inner join CVE C on C.vuln_id = V.vuln_id 
    where V.severity = 3 and C.year < 2009; 
+-------------------------+ 
| count(distinct ip_addr) | 
+-------------------------+ 
|     5071 | 
+-------------------------+ 

這告訴我漏洞比2009年更早的主機的總數,這是一個好的開始。但是,我想更進一步,只包含那些有50個或更多漏洞的主機。我不知道如何做到這一點。主機表中的每個主機條目都有多個相應的漏洞條目。我假設我需要在我的where子句中添加一些內容,但我被卡住了。

在此先感謝。請讓我知道是否需要更多信息。

回答

2

嘗試使用GROUP BYHAVING

SELECT ip_addr 
FROM host AS H 
INNER JOIN vulnerability AS V 
    ON H.host_id = V.host_id 
INNER JOIN CVE AS C 
    ON C.vuln_id = V.vuln_id 
WHERE V.severity = 3 AND C.year < 2009 
GROUP BY ip_addr 
HAVING COUNT(DISTINCT vuln_id) >= 50 

只得到計數包裝其他查詢中上面的查詢:

SELECT COUNT(*) FROM 
(
    SELECT ip_addr 
    FROM host AS H 
    -- etc... same query as above 
) T1 
+0

說簡單,是吧?謝謝。 – Magicked 2011-03-03 21:26:29