Snort mailing list archives
Re: Backend DB's
From: Nigel Houghton <nigel () sourcefire com>
Date: Tue, 8 Jul 2008 11:54:33 -0400
On Tue, 8 Jul 2008 11:47:24 -0400 "Paul Melson" <pmelson () gmail com> wrote:
Well database performance it's self is not a major issue. We are using FLoP right now because the previous Security Engineer here convinced my boss that barnyard was causing issues with us losing the Alerts, the problem turned out to be related to tagged packets, but right now my boss is unwilling to really let us do much in the way of switching systems. We have multiple databases, for a varity of clients. The main issue we are dealing with is some limitations and slowness that we are seeing with reguards to BASE. The inital page takes a while to load up, our db is about 40gb with over 11M rows. It takes BASE about 2-3 minutes to load up (on a good day). I have not been able to get sguile installed and see how well that will work. We have tuned our rule sets down very tight. We are only getting about 100 Alerts a day for our largest clients.As others have pointed out, this is an issue with BASE. I doubt - though it sounds like others would be interested to hear - whether InodeDB will improve performance any significant amount. Probably worth mentioning at this point that I haven't used BASE (or any other PHP web-frontend to Snort) since about 2004.
You could try Squert: http://squert.sourceforge.net/ Means a few changes to the db, but nothing difficult. Maybe even Placid if you want to get away from PHP altogether: http://speakeasy.wpi.edu/placid/ -- Nigel Houghton Resident Hooligan SF VRT ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Backend DB's Craig Van Tassle (Jul 07)
- Re: Backend DB's Russ Combs (Jul 07)
- Re: Backend DB's Paul Melson (Jul 07)
- Re: Backend DB's Craig Van Tassle (Jul 07)
- Re: Backend DB's Randal T. Rioux (Jul 07)
- Re: Backend DB's Jason Haar (Jul 08)
- Re: Backend DB's Nigel Houghton (Jul 08)
- Re: Backend DB's Craig Van Tassle (Jul 07)
- Re: Backend DB's Paul Melson (Jul 08)
- Re: Backend DB's Nigel Houghton (Jul 08)