[Snort-users] DataBase Load Problem.

Jed Pickel jed at ...153...
Thu Nov 30 16:00:35 EST 2000

> MySQL has to do a table lock on each write at present.  

The database plugin does not use any write locks. The schema was
designed such that write locks are not necessary. Are you referring to
some kind of locking MySQL does internally? If so, do you know of a
URL that describes that process?

> For a table with a lot of writing this can get somewhat slow, if
> reads are also waiting to take place. The MySQL folks are working on
> row-level locking, but I don't know how long it will take.
> PostgresSQL might work better under those circumstances, but I don't
> know the Snort support status.

Snort does support PostgreSQL.

> Oracle should certainly be able to keep up, again if it's supported.

Direct oracle support will be added sometime after 1.7 goes out. Does
anyone know the best place to download their client library and
documentation? In the mean time you can use ODBC to log to Oracle.

There are a number of features to be added after 1.7 goes out. Also
when I get some free time I'll get some scripts out to trim and/or
archive snort databases.

* Jed

More information about the Snort-users mailing list