Prewikka performance
Honza Mach <[email protected]> Thu, 29 Jul 2010 15:40:43 +0200
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Organization | CESNET, z.s.p.o. |
| Message-ID | <1280410843.22870.28.camel@omnius> |
Hi everybody, I was wondering, if anyone could give me some information regarding Prewikka performance. I have recently installed Prelude on Debian Lenny system and connected some heavy sensors we have. After the weekend, the MySQL database contained about 6 million entries and the Prewikka interface was absolutely unusable - it could not even render the page after tens of minutes. My first guess was that the database has poor performance. I made some tuning and optimization of InnoDB tables according to the tips here http://www.wzdftpd.net/trac/wiki/Misc/PreludeTips and here http://www.mysqlperformanceblog.com/2007/11/03/choosing-innodb_buffer_pool_size/ , but with absolutely no positive results. Database responded normally via the linux command line, incoming new entries were written in real time and did not get stalled anywhere. So it brought me to the Prewikka. I disconnected some of the heaviest senzors, turned on the MySQL logging and discovered, that for Prewikka to display the alerts listing page with about 2000 entries in the database it has to do about 2000 QUERIES to the database !!! This is absolutely out of my expectations and no wonder that it was impossible to render the alert listing page with 6 million entries in DB. Prewikka reads the entries one by one. Have you any experience with using Prewikka with large amount of data? Are there any options to optimize the queries, so the Prewikka will be usable even for huge amounts of data? Or are there any lightweight alternatives to Prewikka? Have you any experience with Piwi? It seems dead to me. I have considered the pre-filtering of the incoming data in the prelude-manager, so the database will not contain so much of junk, but still, I would like to keep as many of the data as possible. Perhaps this is not the issue of the Prewikka, but instead of the underlaying libpreludedb library. I have to admit, that we are testing the Prelude on the lower-end system (Dell PowerEdge 2650, 4GB RAM), so I did not expected flashing speed, but this in my opinion is too much. Thanks for your time in advance Jan Mach Cesnet, z.s.p.o. www.cesnet.cz _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-technologies.com/mailman/listinfo/prelude-user
smime.p7s
(application/x-pkcs7-signature, 3.1 KB) - not displayed