Re: [Sqlgrey-users] RELEASE: 1.5.9 + with throttling

[Michel B. <mi...@bo...>]

Le Mercredi 08 Juin 2005 11:05, Lionel Bouton a =E9crit :
>
> "It doesn't hurt anyway" isn't enough. It must solve real world
> problems. I'm aware that theoriticaly this is good to have less entries
> in the connect table but as I said earlier the practical benefits aren'=
t
> clear to me yet.

I strongly believe there are benefits, otherwise I wouldn't have asked fo=
r it=20
in the first time then coded it in the end ;-)

Well, I know, I can be mistaken ;-)

> Michel, could you give us a ratio between the results of:
> grep "sqlgrey: grey: throttling: " | wc -l " (on a log spanning the las=
t
> max_connect_age period)
> and
> select count(*) from connect
>
> on your configuration ? This would help measure the benefits of tarpitt=
ing.

I'm not sure my server is a good real-life example, as its traffic is rea=
lly=20
moderate.

OTOH, I've already seen some tapitting in action since I installed it=20
yesterday afternoon, and I recall my "connect" table size had been mutipl=
ied=20
by a factor 10 when the latest M$ worm came out... Hence the idea I had a=
bout=20
tarpitting for fighting this kind of event.
Guess we need another new M$ worm to figure out the benefits it gives whe=
n=20
such an event occurs...

> If other users could fetch Michel's build and test it in the same manne=
r
> too that would be great.

Yep. I'd love to get some feedback.

> # connect cleanup
>
> I'm worrying about the LIKE. There are 2 problems with it:
> - may hurt performance (I've no experience with it, I'm currently
> guessing performance is OK),

It probably won't hurt, as the query still use the main index for IP and=20
sender_domain, leaving the LIKE select a very small subset of entries in=20
connect...

> - I'll have to check SQLite to see if it supports this.

LIKE is a very standard SQL statement... I would be surprised if a decent=
 SQL=20
system didn't implement it.

BTW, have you considered creating the tables with "default 0" for timesta=
mp=20
columns ? "default 0" should be OK with any SQL, isn't it ? And it would=20
prevent MySQL from performing auto-updates...

Cheers.

--=20
Michel Bouissou <mi...@bo...> OpenPGP ID 0xDDE8AC6E