RE: Question about best hardware

[Jason Haar <Jason.Haar () trimble co nz>]

On Sat, 2004-03-06 at 07:07, Kreimendahl, Chad J wrote:
> Hardware won't be your problem.  Once you get around 100k events in the
> snortdb on MySQL you'll run into major performance problems that almost
> no amount of hardware seems to solve.

You're dead right there. 100K does appear to be the limit for me too.

Is this a MySQL-specific issue? How does Postgresql or Oracle handle DBs
over 100K?

Has anyone tried to figure out the problem? There are apparently people
using MySQL with terrabytes of data (nothing to do with snort), so why
is 100K of snort records such a big deal?

Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1




-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users