Stuff

select a.* from (select * from snort.acid_event where timestamp>='2011-06-08 00:00:00' group by sid,plugin_id,plugin_sid) as a,(select * from snort.acid_event where timestamp>='2011-06-08 00:00:00' group by sid,plugin_id,plugin_sid) as b where a.sid!=b.sid and a.plugin_id=b.plugin_id and a.plugin_sid=b.plugin_sid and (UNIX_TIMESTAMP(a.timestamp)-UNIX_TIMESTAMP(b.timestamp))<=2;