SEO

#1 (**permalink**) 04-20-2008, 02:49 PM

Mag Gam wrote:
> While reading this article, History tables and event logging --
> http://www.ibm.com/developerworks/we...a-dbdsgn2.html, I realized I
> try to do event logging in SQL.
>
> My question are: Is SQL a good tool for event logging? Does anyone havea
> sample table sctucture for the most optimal way of event logging? Current I
> have 2 tables. 1 table with timestamps, another with event. Can anyone
> recommend a better way?

It depends on what you want to accomplish in the end. Just storage,
or do you want to perform "complex" queries?

I store my firewall & sshd authtentication attempt logs in a
postgreql database. And I've written a python based web front-end to
view the data, and pull out statistics and such. I also have a "Generate
abuse report" link for when there's been a break-in attempt.

Personally, I see no reason to separate timestamps and event entries,
unless you're getting a lot of events during the same timestamp, and
want to save some space. But there are other factors to consider: How
many events do you get per timestamp? How long times does an insert into
a single table vs two tables take?

You should probably try the simplest possibly solution first, and see
if you need to make it more complex as you can gather empirical data on
how it performs.

--
Kind regards,
Jan Danielsson

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (NetBSD)

iEYEAREKAAYFAkgLFCUACgkQ4AOjoi5TArYnYgCgjXLG/3aXOM0zZmTPn/K63NPs
yjkAmwSzxWIUP4z4/sD+HwtuLL4yIp/w
=Uv5o
-----END PGP SIGNATURE-----

#2 (**permalink**) 04-20-2008, 07:10 PM

Thanks for the responses.

I am planning to run complex queries such as when a event changes
drastically. I also plan on generating several types of reports pertaining
the data. I was wondering if there was a generic but powerful schema for
time series related stuff.

On Sun, Apr 20, 2008 at 5:59 AM, Jan Danielsson <jan.m.danielsson@gmail.com>
wrote:

> Mag Gam wrote:
> > While reading this article, History tables and event logging --
> > http://www.ibm.com/developerworks/we...a-dbdsgn2.html, I
> realized I
> > try to do event logging in SQL.
> >
> > My question are: Is SQL a good tool for event logging? Does anyone have
> a
> > sample table sctucture for the most optimal way of event logging?
> Current I
> > have 2 tables. 1 table with timestamps, another with event. Can anyone
> > recommend a better way?
>
> It depends on what you want to accomplish in the end. Just storage,
> or do you want to perform "complex" queries?
>
> I store my firewall & sshd authtentication attempt logs in a
> postgreql database. And I've written a python based web front-end to
> view the data, and pull out statistics and such. I also have a "Generate
> abuse report" link for when there's been a break-in attempt.
>
> Personally, I see no reason to separate timestamps and event entries,
> unless you're getting a lot of events during the same timestamp, and
> want to save some space. But there are other factors to consider: How
> many events do you get per timestamp? How long times does an insert into
> a single table vs two tables take?
>
> You should probably try the simplest possibly solution first, and see
> if you need to make it more complex as you can gather empirical data on
> how it performs.
>
> --
> Kind regards,
> Jan Danielsson
>
>
>

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

SEO

Re: Database theory question