Menu ▾ ▴

#3 daemon hangs

v0.805
open
nobody
database (1)
5
2004-06-07
2004-06-07
minmin
No

when thousands of events match "notice" list filters,
updating tbl_new_event_allnoticedqueued takes too long,
and causes the daemon to wait indefinitely.

to fix, an index need to be created on the id_ field of
tbl_new_event_allnoticedqueued.
run the following SQL statements

MySQL:
DROP TABLE tbl_new_event_allnoticedqueued;
CREATE TABLE tbl_new_event_allnoticedqueued (
id_ int(11) NOT NULL,
sourceid_ int(11) NOT NULL,
hostname_ varchar(50) NOT NULL,
logfile_ varchar(50) NOT NULL,
source_ varchar(50) NOT NULL,
fulleventid_ int(11) unsigned NOT NULL,
internaleventid_ int(11) NOT NULL,
eventid_ smallint unsigned NOT NULL,
userid_ int(11) NULL,
user_ varchar(100) NULL,
eventtype_ tinyint NOT NULL,
description_ text NOT NULL,
timegenerated_ int(11) NOT NULL,
recordnumber_ int(11) unsigned NOT NULL,
categoryid_ int(11) unsigned NULL,
category_ varchar(50) NULL,
defaultignored_ int(11) NULL,
listnoticed_ int(11) NULL,
isnoticed_ int(11) NULL,
PRIMARY KEY (id_),
KEY IX_tbl_new_event_allnoticedqueued_1 (source_),
KEY IX_tbl_new_event_allnoticedqueued_2 (eventid_)
) TYPE=MyISAM;

MSSQL:
DROP TABLE dbo.tbl_new_event_allnoticedqueued
GO
CREATE TABLE dbo.tbl_new_event_allNoticedQueued (
id_ int NOT NULL,
sourceid_ int NOT NULL,
hostname_ varchar (50) NOT NULL,
logfile_ varchar (50) NOT NULL,
source_ varchar (50) NOT NULL,
fulleventid_ bigint NOT NULL,
internaleventid_ int NOT NULL,
eventid_ int NOT NULL,
userid_ int NULL,
user_ varchar (100) NULL,
eventtype_ tinyint NOT NULL,
description_ varchar(4096) NOT NULL,
timegenerated_ int NOT NULL,
recordnumber_ bigint NOT NULL,
categoryid_ bigint NULL,
category_ varchar (50) NULL,
defaultignored_ int NULL,
listnoticed_ int NULL,
isnoticed_ int NULL,
PRIMARY KEY (id_)
)
GO
CREATE INDEX IX_tbl_new_event_allNoticedQueued_1 ON
dbo.tbl_new_event_allNoticedQueued(source_)
GO
CREATE INDEX IX_tbl_new_event_allNoticedQueued_2 ON
dbo.tbl_new_event_allNoticedQueued(eventid_)
GO

Discussion


Log in to post a comment.