Snort mailing list archives

PostgreSQL vs MySQL?


From: Jesus Couto <jesus.couto () satec es>
Date: Tue, 16 Oct 2001 13:28:36 +0200

Hi.

I'm trying to decide what database backend to use for a "lightweight"
IDS running snort. Basically, the idea is that the machine should not
use a lot of disk, but log everything to the database.

Initially, my thoughs were "well, PostgreSQL supports transactions,
so maybe its safer to use", but looking at the log of whats do a live Snort
writes to a PostgreSQL database, I see that it makes a transaction for
every single insert in every single table, not a transaction for the whole
set of inserts that make an event.

So, my questions are:

1) Why? I mean, there are technical reasons why what I'm asking is not
practical/useful, or is this just product of supporting MySQL and PostgreSQL
and going for the lowest common factor (no transactions), or its just that the only risk is having "incomplete" events in the database (say, headers but not
payload, or something like that), and that was not considered relevant?

2) Any plans to do it that way with Barnyard?

3) Any plans to do it at all?

Thanks in advance,

Jesús Couto F.


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: