Re: anyone willing to share proper syslog SQL schema & data typing?

Marcus J. Ranum wrote:
> Jason Haar wrote:
>   
>> our current file-based structure is really quite slow - so SQL sounds like the way
>> to go.
>>     
>
> Is it slow for inserts, or just slow for searching? Because if inserts
> are currently a problem, using SQL is going to make things worse
> rather than better. Obviously, a database will make searching a lot
> faster depending on what fields you set up as indexed.
>   
inserts are fine - it's the searching that's the pig. And the lack of
constructs like "search between 6pm - 9pm for any "qmail-smtpd" or
"spamd" records containing "marcus" in them". To do that with a mere
filesystem would make - well - lots of directories ;-)



-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1