-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Well database performance it's self is not a major issue. We are using
FLoP right now because the previous Security Engineer here convinced my
boss that barnyard was causing issues with us losing the Alerts, the
problem turned out to be related to tagged packets, but right now my
boss is unwilling to really let us do much in the way of switching
systems. We have multiple databases, for a varity of clients. The
main issue we are dealing with is some limitations and slowness that we
are seeing with reguards to BASE. The inital page takes a while to load
up, our db is about 40gb with over 11M rows. It takes BASE about 2-3
minutes to load up (on a good day). I have not been able to get sguile
installed and see how well that will work. We have tuned our rule sets
down very tight. We are only getting about 100 Alerts a day for our
largest clients.
On Mon, 7 Jul 2008 14:41:28 -0400
"Paul Melson" <pmelson@gmail.com> wrote:
I was wondering what people are using for backend databases.
Currently I use MySQL 5, using myisam for the db engine. We are
looking at moving to InodeDB for the db engine. Our DBA is saying
that we may get some performance improvements. I want to get some
more info as to what people are using and if anyone has any info on
the myisam vs inodedb system.
We're using MySQL with isam. Database performance is a non-issue with
regard to the sensors since we're using barnyard. We typically see
aggregate per-minute alert rates in the double digits, with occasional
spikes into triple digits.
So I guess my bottom line to anyone looking for performance gains
around their sensors is to; 1) use barnyard and 2) tune your rule
set. If database performance is still an issue after that, then
you've got a lot of sensors and should maybe have more than one
database.
PaulM
- --
"An armed society is a polite society. Manners are good when one may
have to back up his acts with his life." Robert A. Heinlein
"Fear is the father of servitude, and the captor of man. There cannot
be slavery without fear, nor freedom with it."
"Only two things are infinite, the universe and human stupidity, and
I'm not sure about the former." -Albert Einstein
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)
iD8DBQFIcmqfRkNuCCPG+0oRAo0qAKCE/sgJ0dgWqaHW7p2N6brc3Ysu4QCdEzxn
LVDfRwzPJfHesQtN/BM4mVc=
=1Ypz
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
