Snort mailing list archives

Re: maxsize of mysql db?


From: "Chris Adams" <chris () improbable org>
Date: Sat, 6 Apr 2002 01:11:48 -0800

This might be offtopic question. I'm a bit worried about my snort since
it's
using mysql as the
backend database and we have a DS3 connection. I can see that it grows so
fast.

Would you know how big the size of the db mysql supports?

The limiting factor is table size.
http://www.mysql.com/doc/T/a/Table_size.html has the gory details - the
limit of a single table is operating system dependent. Figure 4G on modern
stuff, significantly higher on 64-bit platforms.

This turns out not to matter with recent MySQLs - check out the RAID TYPE
argument to create table:
"The RAID_TYPE option will help you to break the 2G/4G limit for the MyISAM
data file (not the index file) on operating systems that don't support big
files. Note that this option is not recommended for file system that
supports big files! You can get more speed from the I/O bottleneck by
putting RAID directories on different physical disks. RAID_TYPE will work on
any OS, as long as you have configured MySQL with --with-raid. For now the
only allowed RAID_TYPE is STRIPED (1 and RAID0 are aliases for this). If you
specify RAID_TYPE=STRIPED for a MyISAM table, MyISAM will create RAID_CHUNKS
subdirectories named 00, 01, 02 in the database directory. In each of these
directories MyISAM will create a table_name.MYD. When writing data to the
data file, the RAID handler will map the first RAID_CHUNKSIZE *1024 bytes to
the first file, the next RAID_CHUNKSIZE *1024 bytes to the next file and so
on. "

The other option to look at is the merge table. This allows you to combine a
number of individual tables into a single table for queries. This works
nicely for logs where you could use small, day/week/month tables for recent
queries while still having the ability to easily query your entire history.

Chris




_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: