[Sguil-users] MySql Database Tuning

[Ramon H. <rhe...@pa...>]

Gang,

 

We finally bit the proverbial bullet and decided to upgrade to SGUIL 0.6.1
last week and onto state-of-the-art servers too (using FreeBSD 6.1).

 

The issue that I am having is the following:

 

When I first installed SGUIL 0.5.3, I noticed that there was a noticeable
slowdown when barnyard would insert data into mysql after a couple of hours.
Back then, one of the folks on the list suggested changing a couple of mysql
database values and this problem was resolved.  Currently, with the new
install, I am noticing the same behavior, of course silly me, I forgot to
document the changes that I had done to mysql that had remedied the issue
back then.  

 

I am still tuning the newly-upgraded sensor to reduce and auto-categorize
many of the events (we are getting 30,000 per hour and I am trying to get
those down to 8,000-9,000 per hour).  I am also still running the previous
sensor and that one receives about 6,500 events per hour with no slowdowns
on much, much, much dated hardware.

 

TIA

 

-RH

 

---

Ramon Hermida

Information Security Specialist

University of Texas Pan American