Snort mailing list archives

Re: My Acid/MySQL setup is mega slow.


From: Ken Gunderson <kgunders () teamcool net>
Date: Thu, 13 Feb 2003 14:44:45 -0700

On Thursday 13 February 2003 01:38 pm, Aaron The Young wrote:
Hi,

I have two Snort sensors setup and both are on PII-333 with 256MB
machines running Debian 3.0.  On one sensor I have MySQL and the
sensor and the other JUST has the sensor and feeds the sensor/sql DB
host.

Am I foolish to think I'd get adequate performance out of this
level of hardware?

The real delay is seen when entering ACID.  When I first started
this project, it took about 20 seconds for ACID to give me a
page when I logged in, now it takes minutes and seems to get
longer and longer as I load up my SQL database with data.

If I need to get a more power SQL server, I'd like confirmation.
If it's just a matter of tuning, what can I do?  Finally, is there
an easy SQL statement to drop the last 30 days of data from my DB?

Thanks in advance.

Aaron

have you done any performance tweaking of mysql?  see mysql docs.  you 
may also want to try throwing some more ram on your db machine.  imho, 
the 256 should be adequate for the sensor only boxen, but what is top 
telling you?

-- 
Best regards,

Ken Gunderson
PGP Key-- 9F5179FD

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.


-------------------------------------------------------
This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your  SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: