[Snort-users] Database performance question (MySQL or PostgreSQL?)

Demetri Mouratis dmourati at ...3877...
Fri Sep 26 12:39:13 EDT 2003


On Fri, 26 Sep 2003, Jyri Hovila wrote:

> Howdy!
>
> Please let's not let this turn this into SQL wars. =)

Thank you.

> I'm currently running several Snort sensors with a central MySQL
> database. Recently the database speed has become a problem. When the
> number of alerts is starting to reach 100 000, ACID is starting to get
> slow. Add another 100 000 alerts and ACID is almost unusable.
>
> My database server is not doing anything else but running MySQL and
> ACID. Here are the specs:
MySQL, php, and apache?
>
> - Pentium II 450 MHz (normally almost totally idle, jumps to 80% when
> making SQL queries)

Ouch.

>
> - 384 RAM (about 50% used, jumps to 60-70% when making queries)

Ouch.

> - 7200 RPM IDE HD (yes, I know...)

Ouch.

> As CPU and RAM utilization is almost never higher than 80% and still the
> queries take awfully long to finish, could the HD be a problem?

All three are a problem.


> I remember seeing discussions about differences between MySQL and
> PostgreSQL performance. If I remember correctly, PostgreSQL was believed
> to be somewhat faster. Could anybody with some real life experience on
> this issue share hers/his knowledge?

http://www.cert.org/kb/acid/
http://www.andrew.cmu.edu/~rdanyliw/snort/perf/acid_perf.html

HTH.
---------------------------------------------------------------------
Demetri Mouratis
dmourati at ...3878...





More information about the Snort-users mailing list