AlienVault R&D Labs Portal. Get the latest news from our research.
Header

Logger benchmarking (commercial edition)

October 12th, 2011 | Posted by DK in Alienvault (Company) | Alienvault OSSIM - (Comments Off)

Hey all,

I don’t want this to become a spam forum, nothing further in my intention than this, but Pascal (pcronauer@alienvault.com) just shared some screenshots with us from a customer PoC, which are much more interesting than any internal benchmark we could do  in the labs.

These screenshots show the Logger performing in the worst case scenario; when the search query is not matched while inserting events on disk. Two pics are provided with about 2 weeks of separation and the hardware is a L3000 appliance.

Results are:

  • ~3 seconds for ~ 2.7 billion events.
  • ~4.5 seconds for ~ 3.2 billion events.

These are the final steps of benchmarking and debugging and this new logger iteration should be available before end of the year (3.1 probably, not sure about the versioning tho). More on the final benchmark in the future, I’m thinking about interviewing some of our key people for the Community/Labs page and having Carlos talk about this would be great.

Huge kudos to everyone involved, specially to Carlos, Juanma and Mihnea :-)

Enjoy!

 

DK

Mr Wolf Wannabe.

More Posts - Website

MySQL Performance Tuning

November 28th, 2007 | Posted by DK in Tuning - (Comments Off)

I’ve finally decided to learn everything I could about MySQL performance tuning; we’re working on highly tuned appliances and this is a must for high-traffic environments.

I’d like to share my first findings on interesting stuff and encourage comments on the matter, which seems as deep as any science.

These last days we’ve discussing about this at the office and we couldn’t agree about the type of database configuration using MySQL was optimal for the broadest range of users.

It’s much easier to tune everything if you already know the exact environment, available hardware and so on, rather than trying to tune a database for a broad range of people going to install a product.

BREAK

Enough of introduction anyway, I want to get to the bottom of this issue once and for all, so for a beginning I ordered these three books:

Besides the books, which should arrive in less than a week, I’ve been googling quite a lot. I really have to try out mirroring an event table into memory from where events are being fetched and writing a copy into disk. I also see that a lot of index and key optimization can be done in all the involved databases.

Anyway, it’s too early to reach a conclusion, in the meantime here’s a very interesting piece of reading about index optimizations.

Other interesting options:

Anyway, if you’ve got an opinion, suggestion or any sort of input about all of this, please share it on the comments section or send me a mail and I’ll post conclusions here.

DK

Mr Wolf Wannabe.

More Posts - Website