From NSMWiki
Jump to: navigation, search

General Tips

Performance Tuning

Check out this great article on mysql server performance tuning. It focuses on the MySQL daemon settings, and shows you how to analyze the stats on your running database server and tune the configuration parameters to tweak performance. It's pretty easy to follow and provides good, practical advice. You can also read this blog entry showing how some of these tips were used in a Sguil environment.

Sguil-Specific Tips

Mass Catagorization of Events Through Database Queries

How do I Expire Old Information From the Database?

Notes on MySQL Usage

Archving the Sguil Database

Here is an excerpt from the sguil-users sourceforge list:

Re: archive script
Subject: 	Re: archive script
List-id: 	<>

There won't (can't) be an archive script that works the way we have
things now due to the changes in the DB. I've been pushing around
different ideas to make sguild handle the archiving itself.  The
easiest way to do that right now is something similar to:

1) Stop sguild
2) Stop mysqld
3) cd /path/to/db/sguildb
4) rm *YYYYMMDD* OR mv *YYYYMMDD* /path/to/archive
5) rm event.* tcphdr.* udphdr.* icmphdr.* data.* sancp.*
6) start mysqld
7) start sguild

That should be relatively quick (faster than the archive script for
those w/big DBs)

And to put archived data back online, just change step 3 to 'cp
/path/to/archive/*YYYYMMDD* /path/to/db/sguildb/'



On 1/9/06, Guy Bruneau <seeker-gy7JKNnsfafD1m2VYDcomQ@xxxxxxxxxxxxxxxx> wrote:
> Are you planning to update it to make it compatible with 0.6.0? It is very
> useful to cleanup the database
> Guy
> Bamm Visscher <bamm.visscher-Re5JQEeQqe8AvxtiuMwx3w@xxxxxxxxxxxxxxxx> wrote:
> The archive script is for 0.5.3 and below, sorry about that.
> On 1/9/06, Guy Bruneau wrote:
> > I was wondering if anyone tried the archive script with Sguil 0.6.0. Is it
> > supposed to delete all daily tables it create when you run the script? I
> ran
> > the script and was left with all of the old tables and the archive file.
> >
> > Guy