[Snort-users] Database sizing and tuning

Joel Esler jesler at ...1935...
Fri Jan 11 10:22:02 EST 2013


On Jan 11, 2013, at 7:35 AM, Mike Miller <mike at ...16027...> wrote:

> Last time I was in the IDS realm, the 'common knowledge' was that you used Mysql for small and medium sized IDS implementations, but when things got bigger, Postgres scaled better. Has that changed? Is there a better alternative? I've got one test system that's currently doing everythign on-box (still building the DB server), and at 800 mbps sustained, mysql is getting pokey after about day three. :D 

I don't think it's a DB issue.  mysql can scale pretty well.  I think it's more having to do with the layout of the DB.  It is about 10 years old at this point and we've turned it over to the barnyard2 folks for redesign.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130111/62fda1ca/attachment.html>


More information about the Snort-users mailing list