Prewikka performance

Honza Mach <[email protected]> Thu, 29 Jul 2010 15:40:43 +0200
Newsgroups gmane.comp.security.ids.prelude.user
Organization CESNET, z.s.p.o.
Message-ID <1280410843.22870.28.camel@omnius>
Hi everybody,

I was wondering, if anyone could give me some information regarding
Prewikka performance.

I have recently installed Prelude on Debian Lenny system and connected
some heavy sensors we have. After the weekend, the MySQL database
contained about 6 million entries and the Prewikka interface was
absolutely unusable - it could not even render the page after tens of
minutes. 

My first guess was that the database has poor performance. I made some
tuning and optimization of InnoDB tables according to the tips here
http://www.wzdftpd.net/trac/wiki/Misc/PreludeTips and here
http://www.mysqlperformanceblog.com/2007/11/03/choosing-innodb_buffer_pool_size/

, but with absolutely no positive results. Database responded normally
via the linux command line, incoming new entries were written in real
time and did not get stalled anywhere.

So it brought me to the Prewikka. I disconnected some of the heaviest
senzors, turned on the MySQL logging and discovered, that for Prewikka
to display the alerts listing page with about 2000 entries in the
database it has to do about 2000 QUERIES to the database !!! This is
absolutely out of my expectations and no wonder that it was impossible
to render the alert listing page with 6 million entries in DB. Prewikka
reads the entries one by one.

Have you any experience with using Prewikka with large amount of data?
Are there any options to optimize the queries, so the Prewikka will be
usable even for huge amounts of data? Or are there any lightweight
alternatives to Prewikka? Have you any experience with Piwi? It seems
dead to me.

I have considered the pre-filtering of the incoming data in the
prelude-manager, so the database will not contain so much of junk, but
still, I would like to keep as many of the data as possible.

Perhaps this is not the issue of the Prewikka, but instead of the
underlaying libpreludedb library.

I have to admit, that we are testing the Prelude on the lower-end system
(Dell PowerEdge 2650, 4GB RAM), so I did not expected flashing speed,
but this in my opinion is too much.

Thanks for your time in advance

Jan Mach
Cesnet, z.s.p.o.
www.cesnet.cz

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user
smime.p7s (application/x-pkcs7-signature, 3.1 KB) - not displayed