sql 查询帮助使用 distinct 和 count()

Question

I have a table containing firewall logs. I'm trying to form a query which will give me a descending report of all connections for past X number of days.

This is the query I have so far:

 select distinct ip_saddr,oob_time_sec,count(*) as cnt 
 from ulog 
 where (oob_prefix like '%INPUT%' and oob_time_sec >= '$phpdays')
 group by ip_saddr 
 order by cnt desc;

 table
 -----------------------------------------------------------------
 ip_saddr     = ip address
 oob_time_sec = time since unix epoch in seconds
 ulog         = database table
 oob_prefix   = string from firewall entry (INPUT_x/OUTPUT_x traffic)

Would like to know if this query looks sane (I'm an Admin wearing a programmer hat, so not too sure).

Thanks!

Answer 1

In my view your Query is right and Proper.

Answer 2

Looks fine to me but I think the LIKE should be like

oob_prefix like 'INPUT%'

since oob_prefix has INPUT_x