rasqlinsert -s -record doesn't seem to work

[Paul Schmehl]

--On October 24, 2012 9:35:16 AM -0400 Carter Bullard <carter at qosient.com> 
wrote:

> Hey Paul,
> We've had this fix in rasqlinsert for quite sometime. Starting on line
> 8410 of rasqlinsert():
>
>       if ((MySQLVersionMajor > 4) || ((MySQLVersionMajor == 4) &&
>                                       (MySQLVersionMinor >= 1)))
>          sprintf (&sbuf[strlen(sbuf)], ") ENGINE=%s",
> ArgusParser->MySQLDBEngine);       else
>          sprintf (&sbuf[strlen(sbuf)], ") TYPE=%s",
> ArgusParser->MySQLDBEngine);
>
> Does your code not have this code ? What version of software are you
> using?
>

3.0.4.1 - clearly this port has a number of issues.  I'm working on an 
update to it now since the maintainer seems to have lost interest.

At least now I understand why it wasn't working.

Next question: why use daily tables instead of one table with daily 
partitioning?  Have you don't any testing between the two?  Searching 
multiple tables requires joins that will increase query time.  Searching 
one table partitioned by day should be much faster.

Of course it's damn hard to know what's best to do until I get a current 
working version of argus setup.  So, I'm working on the port update now and 
doing some speed testing on queries on the one 120 million row table.

-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell