Snort mailing list archives

Efficiency of acid_event


From: "Michael T. Babcock" <mbabcock () fibrespeed net>
Date: Wed, 18 Dec 2002 09:48:11 -0500

In the table acid_event, since sig_name is the only value that is variable sized, would it not make the table much more efficient to use an ID reference to another table for the signature name? Assuming that the data from acid_event is used without the sig_name in some or many queries (unknown to me; this may invalidate the comment), queries using acid_event would be faster (at least on MySQL) if this table were entirely fixed-length rows.

CREATE TABLE acid_event_sig_name (
sig_id tinyint unsigned not null auto_increment primary key,
sig_name varchar(255)
);

INSERT INTO acid_event_sig_name (sig_name) SELECT DISTINCT(sig_name) from acid_event;

ALTER TABLE acid_event add sig_id tinyint unsigned not null after sig_name;

... just a thought. Comments? (I'm not subscribed to the list, so please CC me).

--
Michael T. Babcock
C.T.O., FibreSpeed Ltd.
http://www.fibrespeed.net/~mbabcock




-------------------------------------------------------
This SF.NET email is sponsored by: Order your Holiday Geek Presents Now!
Green Lasers, Hip Geek T-Shirts, Remote Control Tanks, Caffeinated Soap,
MP3 Players,  XBox Games,  Flying Saucers,  WebCams,  Smart Putty.
T H I N K G E E K . C O M       http://www.thinkgeek.com/sf/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: