RE: Question about best hardware

[SN ORT <snort_on_acid () yahoo com>]

I used to have a bear of a time with over 100K, then I
added a second processor and now I can manage the
alerts in at least half the time, even though MySQL is
not multi-threaded, it seems that ACID was taking a
big chunk of that as well making the SQL calls...etc,
so ACID would go on one proc and MySQL on the other
and I saw a giant performance gain.

Cheese!

Marc

> Message: 2
> Subject: RE: [Snort-users] Question about best
hardware
> From: Jason Haar <Jason.Haar () trimble co nz>
> To: snort-users () lists sourceforge net
> Organization: Trimble Navigation Ltd.
> Date: Mon, 08 Mar 2004 09:02:24 +1300

> On Sat, 2004-03-06 at 07:07, Kreimendahl, Chad J
wrote:
> > Hardware won't be your problem.  Once you get
around 100k events in the
> > snortdb on MySQL you'll run into major performance
problems that almost
> > no amount of hardware seems to solve.

> You're dead right there. 100K does appear to be the
> limit for me too.

<snip>

__________________________________
Do you Yahoo!?
Yahoo! Search - Find what you’re looking for faster
http://search.yahoo.com


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users