[Snort-users] [Fwd: Limits to what ACID can handle?]

Vitaly Osipov vosipov at ...2096...
Mon Jun 11 12:11:58 EDT 2001


Hi ppl,

this was on Focus-ids list regarding ACID - is it true that mysql is not
able to handle big databases? (>1mln records)

regards,
Vitaly
-------------- next part --------------
Return-Path: <focus-ids-return-258-vosipov=wolfegroup.ie at ...35...>
Received: from mx1.wolfegroup.ie ([10.100.32.10]) by
          endeavour.wolfegroup.ie (Netscape Messaging Server 4.15) with
          ESMTP id GEMWFY00.R67 for <vosipov at ...2096...>; Sat, 9 Jun
          2001 00:11:58 +0100 
Received: from outgoing.securityfocus.com (localhost [127.0.0.1])
	by mx1.wolfegroup.ie. (8.11.3/8.11.3) with SMTP id f58NBhf24008
	for <vosipov at ...2096...>; Fri, 8 Jun 2001 23:11:43 GMT
Received: from lists.securityfocus.com (lists.securityfocus.com [66.38.151.19])
	by outgoing.securityfocus.com (Postfix) with SMTP id F11B49509F
	for <vosipov at ...2096...>; Fri,  8 Jun 2001 17:11:43 -0600 (MDT)
Received: (qmail 24322 invoked by alias); 8 Jun 2001 21:24:27 -0000
Mailing-List: contact focus-ids-help at ...35...; run by ezmlm
Precedence: bulk
List-Id: <focus-ids.list-id.securityfocus.com>
List-Post: <mailto:focus-ids at ...35...>
List-Help: <mailto:focus-ids-help at ...35...>
List-Unsubscribe: <mailto:focus-ids-unsubscribe at ...35...>
List-Subscribe: <mailto:focus-ids-subscribe at ...35...>
Delivered-To: mailing list focus-ids at ...35...
Delivered-To: moderator for focus-ids at ...35...
Received: (qmail 13900 invoked from network); 8 Jun 2001 19:20:35 -0000
Message-ID: <B6E52B5EDFAFD411BA42009027AE9D58078C9A79 at ...2214...>
From: "Kohlenberg, Toby" <toby.kohlenberg at ...1966...>
To: FOCUS-IDS at ...35...
Subject: Limits to what ACID can handle?
Date: Fri, 8 Jun 2001 12:11:53 -0700 
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
X-Mozilla-Status2: 00000000

Has anyone run into limits in mysql and/or ACID? I loaded
a network dump that had ~880k alerts+packet dumps last night
into a Win2k mysql+ACID install. It was doing okay up through
100k-200k entries then I went away and when I came back I
failed to get any response at all. I'm curious if I'm doing something
else wrong or if I've just run into a limitation of the packages.

Thanks,
Toby
(all opinions are my own and in no way reflect the views of my employer)

-------------- next part --------------
Return-Path: <focus-ids-return-272-vosipov=wolfegroup.ie at ...35...>
Received: from mx1.wolfegroup.ie ([10.100.32.10]) by
          endeavour.wolfegroup.ie (Netscape Messaging Server 4.15) with
          ESMTP id GERVVI00.RBI for <vosipov at ...2096...>; Mon, 11 Jun
          2001 16:47:42 +0100 
Received: from outgoing.securityfocus.com (localhost [127.0.0.1])
	by mx1.wolfegroup.ie. (8.11.3/8.11.3) with SMTP id f5BFlVf19760
	for <vosipov at ...2096...>; Mon, 11 Jun 2001 15:47:31 GMT
Received: from lists.securityfocus.com (lists.securityfocus.com [66.38.151.19])
	by outgoing.securityfocus.com (Postfix) with SMTP id E340B8FCDE
	for <vosipov at ...2096...>; Mon, 11 Jun 2001 09:47:24 -0600 (MDT)
Received: (qmail 8655 invoked by alias); 11 Jun 2001 15:20:26 -0000
Mailing-List: contact focus-ids-help at ...35...; run by ezmlm
Precedence: bulk
List-Id: <focus-ids.list-id.securityfocus.com>
List-Post: <mailto:focus-ids at ...35...>
List-Help: <mailto:focus-ids-help at ...35...>
List-Unsubscribe: <mailto:focus-ids-unsubscribe at ...35...>
List-Subscribe: <mailto:focus-ids-subscribe at ...35...>
Delivered-To: mailing list focus-ids at ...35...
Delivered-To: moderator for focus-ids at ...35...
Received: (qmail 30024 invoked from network); 11 Jun 2001 06:06:16 -0000
Date: Mon, 11 Jun 2001 01:17:58 -0500 (CDT)
From: Greg Shipley <gshipley at ...1334...>
To: Ruprecht Jaeschke <jaeschke at ...2215...>
Cc: <FOCUS-IDS at ...35...>
Subject: Re: Limits to what ACID can handle?
In-Reply-To: <004701c0f19b$fbe6b680$fe78a8c0 at ...2216...>
Message-ID: <Pine.LNX.4.30.0106110113530.25429-100000 at ...1335...>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Mozilla-Status2: 00000000


I've heard ramblings from *cough* Marty *cough* *cough* people saying that
mySQL doesn't hold up as well as some other DBs past 1 million records.
I'm no RDBMS guru, but this wouldn't surprise me.  In fairness to mySQL,
I'm not sure how many mySQL deployments have pushed the one million mark.

Us security folks are always pushing/breaking things.... :)

Can anyone with a real DB background confirm this?

-Greg




More information about the Snort-users mailing list