https://groups.google.com/forum/#!topic/security-onion/tv3sGFN7wo8 Maybe GROUP BY signature_id, signature_gen as a fix.