Re: [Prelude Hybrid IDS] #239: postgres specific handling of min and max times in groupings

well after significant investigation I found there was no practical way to
fix ticket #52 without using subqueries, and even then the subqueries
requiered decreased preformance exponentialy. this is because you cant use
MIN() or MAX() in WHERE clauses, furthermore the subqueries would need all
of the conditions of the parent query.

there is an other way i found to produce the same result as this patch which
should be database generic in the initial query used to get list of the
agrigated alerts MAX(time) if MIN(time) is used as well the query can be
targeted to using a WHERE clause to match the exact time this has a
comperable effect on postgresql and should work on mysql as well. it might
also yeald a speed increase on mysql but it would need to be tested.



On 6/14/07, Prelude Hybrid IDS <[email protected]> wrote:
>
> #239: postgres specific handling of min and max times in groupings
>
> ---------------------------------+------------------------------------------
> Reporter:  [email protected]  |        Owner:  yoann
>      Type:  enhancement          |       Status:  new
> Priority:  high                 |    Milestone:  Prewikka 0.9.12
> Component:  prewikka             |      Version:  0.9
> Severity:  normal               |   Resolution:
> Keywords:                       |
>
> ---------------------------------+------------------------------------------
> Comment (by yoann):
>
> Replying to [ticket:239 [email protected]]:
> > here is a patch to handle min and max alert time in groupings
> differently on postgresql than other databases. this patch will not effect
> mysql or sqllite users.
> > the methodology used in the patch for postgresql should also be tested
> under sqllite I suspect it will have the same effect but im not sure.
>
>
> Hello Paul, and thanks for your patch!
>
> We are currently on our way to fixing several issues with the databases
> schema. Therefore I am going to wait until this is finished before making
> any change in the way we perform query to the database system, since
> improving the schema will impact the query themselves.
>
> Concerning your patch, rather than solving the MIN/MAX problem in
> Prewikka, which involve using different path for different database, it
> would be interesting to have a look at fixing ticket #52, which would
> finally permit to fix the issue in a database independent way.
>
> Making the query different depending on the database in Prewikka itself
> defeat the abstraction purpose of libpreludedb, and make the code more
> error prone and difficult to debug. So I would be willing to investigate
> this, but only as a last resort if we have no solution to the main
> problem.
>
> Regards,
>
> --
> Ticket URL: <https://trac.prelude-ids.org/ticket/239#comment:1>
> Prelude Hybrid IDS <http://www.prelude-ids.org>
> The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel