[Snort-users] Problems with base and postgresql

Michael Stone mstone+snort at ...10946...
Tue Apr 5 12:55:38 EDT 2005

On Tue, Apr 05, 2005 at 11:51:09AM -0700, Aaron Glenn wrote:
>On Apr 4, 2005 7:52 AM, Michael Stone <mstone+snort at ...10946...> wrote:
>> I'd suggest not doing this, it'll really hurt if your system ever
>> crashes. Base is really not tuned for postgres right now--if you want
>> decent performance you're better off just running mysql.
>What, specifically, needs "tuning" ?

For example, there are a lot of instances of count(*) in the code. mysql
shortcuts that operation by keeping a counter, but in postgres that
triggers a sequential scan of the table--which can take a while for a
large table. There are also some spots where queries could be rewritten
to be more efficient by throwing in some joins instead of doing multiple
queries and other such items. I've been poking at the code to speed
things up, but now I'll have to reintegrate with the new release before
sending up a patch & I still need to go back and test that mysql still
works after the changes.

Mike Stone

More information about the Snort-users mailing list