[Snort-users] PostgreSQL Indexes

Gfm gfm at ...6046...
Tue Jun 11 08:31:51 EDT 2002


Hi, I'm currently implementing snort on openbsd 3.1
using PostgreSQL.

I read in the ACID FAQ that' "Many of the required
indexes are not created in initial PostgreSQL creation
script. At a minimum the following fields should have
indexes created on them: " 

event.timestamp 
event.signature 
signature.sig_name 
iphdr.ip_src 
(DB schema < v103) iphdr.ip_src0 + iphdr.ip_src1 + iphdr.ip_src2 + iphdr.ip_src3 
iphdr.ip_dst 
(DB schema < v103) iphdr.ip_dst0 + iphdr.ip_dst1 + iphdr.ip_dst2 + iphdr.ip_dst3 
tcphdr.tcp_sport 
tcphdr.tcp_dport 
acid_ag_alert.ag_sid + acid_ag_alert.ag_cid 

The problem it's that I'm pretty new on PostgreSQL,
can anyone please help me in creating those indexes. 

It's recommended to create any other index to improve
the ACID/Snortreport performance?

Thanks a lot for your help

Gus





More information about the Snort-users mailing list