[Snort-users] Purchasing New Equipment for Snort

Martin Holste mcholste at ...11827...
Wed Apr 20 23:26:35 EDT 2011

> Thanks for this information. One our sys admins had discussed with me that a change to innodb could improve performance. I know that the default snort schema uses myisam, so I wasn't sure if innodb could be used. Does anything special need to be done in addition to changing the table type and making sure the key buffer size is large enough?

You can change variables either at run-time or permanently in the
config file (my.cnf).  MySQL ships with example config files which
(varying by Linux distro) will be called something like
/usr/share/doc/mysql-server-5.1/examples/my-innodb-heavy-4G.cnf.gz (on
Ubuntu) which serve as an example.  See the MySQL documentation for
details.  Another great resource is the mysqlperformanceblog.com for
in-depth details.  They also put out an ultra-tricked-out version of
MySQL called XtraDB which is designed for enormous (think Facebook)

> On the MySQL 5.5 issue, should we see a performance increase just by upgrading the server version? I'm sure you know that BASE uses the adodb libraries and they aren't updated often. I'm not sure about Barnyard, can it use MySQL 5.5 client libraries if compiled with 5.5 installed?
Yes, you should see up to a 30% increase in overall performance when
using 5.5 over 5.1 and below simply by upgrading.  The gains are
mostly because of vastly improved threading which means that 5.5 will
utilize multiple cores much more effectively.  There are both RPM's
and .deb packages for 5.5, so you should be able to do a straight
upgrade on your distro, and everything should be backward compatible.
The client programs like adodb and barnyard will not have any problems
with the new version and will fully take advantage of the faster
response from the server.

More information about the Snort-users mailing list