RE: Snort to Oracle

["Kreimendahl, Chad J" <Chad.Kreimendahl () umb com>]

I'd beg to differ about MySQL.  We had a very well tuned MySQL that once
it got over 200k records and tried to return data using the same join we
use in oracle... It took well over several minutes (past browser
timeout), all while oracle does it in 40ms.  I've seen several million
events (over 10 million total rows of data) in Oracle work exactly the
way it should... Return data at the same rate in our join query as it
did when it was only 10k records.

My experience with MySQL is that its indexing is terrible, and even
simple joins take entirely too long to return.

Oracle's problem:  the very fun installation (which can take gigs of
space).  Plus, the majority of headers and libs needed to run things
such as perl's DBD::Oracle are only included in the full install.
Though, you could probably go into full and uncheck some of the extra
stuff...  

You may also want to try the lite version of Oracle that's out now.

-----Original Message-----
From: Steve Suehring [mailto:snort () braingia org] 
Sent: Friday, January 03, 2003 1:24 PM
To: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Snort to Oracle


On Fri, Jan 03, 2003 at 01:07:53PM -0500, Nicholas Bachmann wrote:
> > I am getting well over 15K detected attempts a day and my database
> > grows too quickly for MySql to handle (my current setup)

MySQL shouldn't have any problems handling 15K of anything per day.  

I personally wouldn't have much faith in Oracle handling it better, all
things being equal.  Oracle has higher overhead and 15K of records isn't
that much data to begin with.  Obviously if you're running MySQL on a
486
and Oracle on a P4 there would be a difference.  :)

Are there specific issues that you're seeing with MySQL?

Steve


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users