Re: [Secureideas-base-user] re: Base has become unuseable.

[Michael S. <ms...@ma...>]

On Tue, Mar 28, 2006 at 04:54:01PM -0500, Jacob, Raymond A Jr wrote:
>>> I intrepet from your answer that combination of mysql and the default base
>>> schema can not handle databases over 2GB? Is that a correct assumption?

There's no hard number, mysql performance simply (in my experience) 
falls off a cliff once the number of alerts gets high enough. The number 
is going to depend on what sort of queries you're doing and what kind of 
hardware you have. The fundamental problem with the current schema is 
that it unnecessarily duplicates a lot of data, which leads to a lot of 
maintenance overhead (acid cache tables, deletes, etc.) and makes it 
harder to cache a working set in memory. You can get around that by 
eliminating the duplicate data and doing simple joins instead. But if 
you go that route on mysql you run into limitations in mysql's ability 
to handle complex queries. (Which is also a practical problem with the 
standard schema, since in most cases when you're using huge dbs you're 
going to be doing relatively complex queries to pare the data down to 
something managable.) 

>>> Or are you saying that I need a faster CPU?

More CPU isn't going to help much. More memory might push your limits 
higher.

I note that I misread the version number in your email; I don't think 
upgrading is going to buy you much in terms of performance over what 
you're running now.

Mike Stone