Snort mailing list archives

Re: Backend DB's


From: "Paul Melson" <pmelson () gmail com>
Date: Mon, 7 Jul 2008 14:41:28 -0400

I was wondering what people are using for backend databases. Currently
I use MySQL 5, using myisam for the db engine. We are looking at moving
to InodeDB for the db engine. Our DBA is saying that we may get some
performance improvements. I want to get some more info as to what
people are using and if anyone has any info on the myisam vs inodedb
system.

We're using MySQL with isam.  Database performance is a non-issue with
regard to the sensors since we're using barnyard.  We typically see
aggregate per-minute alert rates in the double digits, with occasional
spikes into triple digits.

So I guess my bottom line to anyone looking for performance gains around
their sensors is to; 1) use barnyard and 2) tune your rule set.  If database
performance is still an issue after that, then you've got a lot of sensors
and should maybe have more than one database.

PaulM




-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: