Linux-audit Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Clif Flynt <clif@cflynt.com>
To: Steve Grubb <sgrubb@redhat.com>
Cc: linux-audit@redhat.com, Clif Flynt <clif@cflynt.com>
Subject: SQLite Clarification
Date: Mon, 31 Jul 2006 16:05:23 -0400	[thread overview]
Message-ID: <20060731200523.GA1183@clif.cflynt.com> (raw)
In-Reply-To: 20060731171437.GA447@clif.cflynt.com

On Mon, Jul 31, 2006 at 01:54:30PM -0400, Steve Grubb wrote:
> On Monday 31 July 2006 13:14, Clif Flynt wrote:
>
> >   My current report generator builds an SQLite database on the fly from
> > the flat ASCII logs.
> 
> Seems like this would be ideal to marry to the realtime audit event interface. 
> You would set log_format = nolog, dispatcher = /sbin/your-dispatcher, and 
> disp_qos = lossless to keep the audit system from writing to disk, send 
> events to a program, and use blocking comminucation to do it.
> 
> >   I'm using SQLite instead of mySQL or Postgres because it it's fast,
> > mature and robust and doesn't  require any database server (or dbadmin)
> > to run it.
> 
> I've been looking at using it too. I read some issues that made me wonder if 
> it was really suitable:
> 
> http://www.sqlite.org/whentouse.html
> 
> At the bottom it mentions that if something has the database open for read, 
> then writing is blocked. And the issue about the journal using 256 bytes for 
> event MB of data made me wonder also.

  My other reason for using SQLite is that I'm working with the
developer.  I forwarded your concerns to Richard Hipp, and received
this response:

> The database file is only locked for the duration
> of the write operation - not while the database is open.  A write
> normally takes a few milliseconds, then the lock goes away.
> 
> Why is 256 bytes of data for each 1MiB of database a problem?
> Is memory so short and databases so large that this might cause
> a problem?
> 
> If it is, then increase the page size from the default 1K.
> The actually usage is 2 bits per page of data.  So if pages
> are 32KiB bytes instead of 1KiB, a 1MiB database only needs
> 8 bytes of storage for the bitmap.
> 
> --
> D. Richard Hipp   <drh@hwaci.com>

  Clif

-- 
.... Clif Flynt ... http://www.cflynt.com ... clif@cflynt.com ...
.. Tcl/Tk: A Developer's Guide (2nd edition) - Morgan Kauffman ..
..13th Annual Tcl/Tk Conference:  Oct 9-13, 2006,  Chicago, IL ..
.............  http://www.tcl.tk/community/tcl2006/  ............

  parent reply	other threads:[~2006-07-31 20:06 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2006-07-31 17:14 New List Member: Intro & comments Clif Flynt
2006-07-31 17:54 ` Steve Grubb
2006-08-07  9:37   ` Marcus Meissner
2006-07-31 20:05 ` Clif Flynt [this message]
2006-07-31 21:13   ` SQLite Clarification Steve Grubb
2006-08-02 20:49     ` auditctl question Lane Williams
2006-08-02 22:03       ` Steve Grubb
2006-08-02 22:15         ` Linda Knippers
2006-08-02 22:29           ` Steve Grubb
2006-08-03  0:22       ` Klaus Weidner
2006-08-03 13:00         ` Williams, P. Lane
2006-08-03 15:18           ` Klaus Weidner
2006-08-03 20:02             ` Williams, P. Lane
2006-08-03 20:29               ` Klaus Weidner
2006-08-03 21:06               ` Steve Grubb
2006-08-04  1:50                 ` Williams, P. Lane
2006-08-04 10:28                   ` Steve Grubb
2006-08-04 12:48                     ` Lane Williams
2006-07-31 22:05   ` SQLite Clarification Clif Flynt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20060731200523.GA1183@clif.cflynt.com \
    --to=clif@cflynt.com \
    --cc=linux-audit@redhat.com \
    --cc=sgrubb@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox