[Snort-users] Problems with base and postgresql

Frank Knobbe frank at ...9761...
Tue Apr 5 15:06:57 EDT 2005

On Tue, 2005-04-05 at 15:54 -0400, Michael Stone wrote:
> For example, there are a lot of instances of count(*) in the code. mysql
> shortcuts that operation by keeping a counter, but in postgres that
> triggers a sequential scan of the table--which can take a while for a
> large table. 

This can be solved by counting an element that is indexed instead of *,
for example, if a single index for ip_src exist, count(ip_src) is faster
than count(*) as it will to a scan on the index.

Also, don't forget about tricks like "limit 1" etc. Queries can, and
should be tuned, to each individual database in order to achieve maximum

Perhaps one size does not fit all, and someone might want to create a
BASE-pg and BASE-mysql version or something. But since it's open source,
everyone is welcome to tweak their own stuff.

Postgres performance tuning is borderline to a black-art. But once tuned
(server and application)... man... it just rocks.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050405/beb8a535/attachment.sig>

More information about the Snort-users mailing list