[Snort-devel] database schema: postgresql

Roman Danyliw roman at ...49...
Thu Mar 7 13:11:01 EST 2002


- What were the changes you made to the schema?
- As a baseline, do you know how long it takes to delete 44k of alerts with the
current schema after you VACCUM ANALYZE?
- How were you deleting the events?
- What version of PostgreSQL?
- Hardware?
- Relevant kernel/postgresql.conf settings?

cheers,
Roman

On Thu, 7 Mar 2002 20:05:47 -0500 (EST), Edward Balas <ebalas at ...1183...> wrote
:

> Hey all,
> 
> As a follow up to my comments earlier with week...
> 
> I ran some tests with a schema that had referential integrity plus
> cascading deletes.  For 44k events it took over 4 hours to delete!
> Clearly this required some investigation into the schema because I had
> tweeked the kernel and postgresql.conf as well I knew how (which isnt
> saying much)  ;-)
> 
> anywho after investigating the issue with a colleague and determining that
> my logic wrt indexing on foreign keys as faulty, I tried a revised schema.
> This time prior to doing the delete I also ran "vaccum analyze".
> 
> In my second test the ET dropped to 26 seconds!
> 
> So the real question now is what kind of affect will this have on insert
> rates.
> 
> Anywho I guess this goes to show how far a little bit of lovin'
> will go with a DBMS...
> 
> Ed
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 
> 
> 
> 




More information about the Snort-devel mailing list