Re: Prewikka performance
Russell Fulton <[email protected]> Sat, 7 Aug 2010 11:17:34 +1200
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
we have around 1 million events in a mysql database and response from prewikka is far from sparkling. I too would be interested in knowing how well prelude scales. Looking at the DB schema there are a lot of tables and I suspect that you end up doing a *lot* of joins for most queries. Russell On 6/08/2010, at 9:23 PM, Honza Mach wrote: > Hi everybody, > > does anyone has any information about prewikka performance to share with > me? > > Regards > > --- > Jan Mach > Cesnet, z.s.p.o. > www.cesnet.cz > > From: Honza Mach <[email protected]> > Date: 30 July 2010 1:40:43 AM NZST > To: <[email protected]> > Subject: [prelude-user] Prewikka performance > Reply-To: <[email protected]> > > > Hi everybody, > > I was wondering, if anyone could give me some information regarding > Prewikka performance. > > I have recently installed Prelude on Debian Lenny system and connected > some heavy sensors we have. After the weekend, the MySQL database > contained about 6 million entries and the Prewikka interface was > absolutely unusable - it could not even render the page after tens of > minutes. > > My first guess was that the database has poor performance. I made some > tuning and optimization of InnoDB tables according to the tips here > http://www.wzdftpd.net/trac/wiki/Misc/PreludeTips and here > http://www.mysqlperformanceblog.com/2007/11/03/choosing-innodb_buffer_pool_size/ > > , but with absolutely no positive results. Database responded normally > via the linux command line, incoming new entries were written in real > time and did not get stalled anywhere. > > So it brought me to the Prewikka. I disconnected some of the heaviest > senzors, turned on the MySQL logging and discovered, that for Prewikka > to display the alerts listing page with about 2000 entries in the > database it has to do about 2000 QUERIES to the database !!! This is > absolutely out of my expectations and no wonder that it was impossible > to render the alert listing page with 6 million entries in DB. Prewikka > reads the entries one by one. > > Have you any experience with using Prewikka with large amount of data? > Are there any options to optimize the queries, so the Prewikka will be > usable even for huge amounts of data? Or are there any lightweight > alternatives to Prewikka? Have you any experience with Piwi? It seems > dead to me. > > I have considered the pre-filtering of the incoming data in the > prelude-manager, so the database will not contain so much of junk, but > still, I would like to keep as many of the data as possible. > > Perhaps this is not the issue of the Prewikka, but instead of the > underlaying libpreludedb library. > > I have to admit, that we are testing the Prelude on the lower-end system > (Dell PowerEdge 2650, 4GB RAM), so I did not expected flashing speed, > but this in my opinion is too much. > > Thanks for your time in advance > > Jan Mach > Cesnet, z.s.p.o. > www.cesnet.cz > _______________________________________________ > Prelude-user site list > [email protected] > http://lists.prelude-technologies.com/mailman/listinfo/prelude-user > > _______________________________________________ > Prelude-user site list > [email protected] > http://lists.prelude-technologies.com/mailman/listinfo/prelude-user _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-technologies.com/mailman/listinfo/prelude-user