RE: Question about best hardware

[Michael Miller <michael.miller () state co us>]

Any pointers for tuning? I've turned off the 'update on page load', but I
still see some huge wait times.

-----Original Message-----
From: Josh Berry [mailto:josh.berry () netschematics com] 
Sent: Monday, March 08, 2004 12:32 PM
To: Jason Haar
Cc: snort-users () lists sourceforge net
Subject: RE: [Snort-users] Question about best hardware

I don't have a performance issue over 100K.  My DB has reached into the
Gig's before and been fine, I just spread the load, tune MySQL/Apache/and
the ACID config file and am fine.  Once a week I run an optimize table
script.  I have a dual P4 2.0 Gig System with 2 Gigs of RAM running the DB
and a dual P4 2.0 Gig System with 1 Gig of RAM running the web interface. 
I also keep all of the sensors separate from the servers.

I have also performance tuned the TCP/IP, Disk IO, and CPU settings where
I could.  I keep Apache (Redhat Version) up-to-date but run an older MySQL
(from MySQL.com) version (3.23.56).


> On Sat, 2004-03-06 at 07:07, Kreimendahl, Chad J wrote:
> > Hardware won't be your problem.  Once you get around 100k events in the
> > snortdb on MySQL you'll run into major performance problems that almost
> > no amount of hardware seems to solve.
>
> You're dead right there. 100K does appear to be the limit for me too.
>
> Is this a MySQL-specific issue? How does Postgresql or Oracle handle DBs
> over 100K?
>
> Has anyone tried to figure out the problem? There are apparently people
> using MySQL with terrabytes of data (nothing to do with snort), so why
> is 100K of snort records such a big deal?
>
> Cheers
>
> Jason Haar
> Information Security Manager, Trimble Navigation Ltd.
> Phone: +64 3 9635 377 Fax: +64 3 9635 417
> PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
>
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: IBM Linux Tutorials
> Free Linux tutorial presented by Daniel Robbins, President and CEO of
> GenToo technologies. Learn everything from fundamentals to system
> administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


Thanks,
Josh Berry, CISSP
CTO, VP of Product Development
LinkNet-Solutions
469-831-8543
josh.berry () linknet-solutions com



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users