I'm looking for some help choosing a database backend for a iptables ulogd setup.
We are going to swap out our current proprietary firewall solution with iptables and one of the requirements is to log all traffic being forwarded by the firewall.
Looking at our current logs, we log about 4000000-5000000 entries pr 24 hours so the database should be fast on inserts.
The server is a Debian Wheezy setup so we prefer to use a database which can be maintained via aptitude.
We are currently looking at the following:
- Mysql 5.5 (debian repository)
- MariaDB 5.5
- Percona 5.6
- SQLite 3
After choosing a database, there is also the question of which storage engine fits our workload?
I'm been playing a little with the idea of having ulogd insert into a in-memory engine and then move the data to a on-disk based storage engine database in intervals, has anyone done something similar before?