[Snort-users] Mysql or Postgres?

roman at ...438... roman at ...438...
Thu Mar 29 10:00:11 EST 2001


This is one of the proverbial questions when choosing an
open source database.

It has been true in the past that MySQL was "fast", but this
was largely due to the fact that it did not support real DB
constructs like transactions.  Therefore, ISAM tables are fast,
but if you move to Berkeley tables (with Sleepy Cat transaction
support) this is no longer the case.  However, in the Snort
context this argument is almost mute since ISAM tables 
are almost always used.

Out of the box PostgreSQL is slower that MySQL in Snort logging.
However, my understanding is that PostgreSQL performance can 
be greatly improved by disabling fsync() ing making it comparable
to MySQL.  Checkout the following benchmark of PostgreSQL vs.
MySQL released about some PostgreSQL optimizations:

http://www.phpbuilder.com/columns/tim20000705.php3 

As Umit points out, INSERT speed is of paramount concern to 
an NIDS.   So most of our arguments have surrounded this issue.
However, I have to confess the support for views, sub-selects,
native transactions support is really nice in PostgreSQL.  If
I was choosing a database for general purposes these would
be very important features to me (and developments in ACID).  

comments?
Roman

> I'm not a database guru either, but as far as I know, it is not just a
> preference... MySQL has been written with considering the speed as the
> most important requirement. It is really fast, however it lacks some of
> the features required by the SQL standard. On the other hand, PostgreSQL
> offers more SQL compliance. Considering a IDS view, IMHO, speed is more
> important than SQL compliance, so MySQL is preferable as an IDS database
> than Postgres, I think. For more information about MySQL and Postgres
> benchmarks, visit:
> 
> http://www.mysql.com/information/benchmarks.html
> 
> Hope this helps a bit...
> 
> > Talking about the mysql/postgres issue: 
> > I am not quite the database guru I wish I was, so I am wondering what the
> > pros/cons and other issues in the choice between mysql and postgres as an
> > intrusion detection database.
> > 
> > Is it just (more or less) a preference choice or are there more important
> > things to consider?
> > 
> > Wishing for some guidance...
> 
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 



---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/






More information about the Snort-users mailing list