[Snort-users] Snort to Oracle

Kreimendahl, Chad J Chad.Kreimendahl at ...4716...
Fri Jan 3 16:26:03 EST 2003

I'd beg to differ about MySQL.  We had a very well tuned MySQL that once
it got over 200k records and tried to return data using the same join we
use in oracle... It took well over several minutes (past browser
timeout), all while oracle does it in 40ms.  I've seen several million
events (over 10 million total rows of data) in Oracle work exactly the
way it should... Return data at the same rate in our join query as it
did when it was only 10k records.

My experience with MySQL is that its indexing is terrible, and even
simple joins take entirely too long to return.

Oracle's problem:  the very fun installation (which can take gigs of
space).  Plus, the majority of headers and libs needed to run things
such as perl's DBD::Oracle are only included in the full install.
Though, you could probably go into full and uncheck some of the extra

You may also want to try the lite version of Oracle that's out now.

-----Original Message-----
From: Steve Suehring [mailto:snort at ...7160...] 
Sent: Friday, January 03, 2003 1:24 PM
To: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Snort to Oracle

On Fri, Jan 03, 2003 at 01:07:53PM -0500, Nicholas Bachmann wrote:
> > I am getting well over 15K detected attempts a day and my database
> > grows too quickly for MySql to handle (my current setup)

MySQL shouldn't have any problems handling 15K of anything per day.  

I personally wouldn't have much faith in Oracle handling it better, all
things being equal.  Oracle has higher overhead and 15K of records isn't
that much data to begin with.  Obviously if you're running MySQL on a
and Oracle on a P4 there would be a difference.  :)

Are there specific issues that you're seeing with MySQL?


This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list