HP Integrity rx1620 Server 1.60 GHz 267 MHz FSB Base System AB431A#0D1 产品宣传页
产品代码
AB431A#0D1
Time-based organization
The data on each processing node in a CLW cluster is partitioned in time ranges. This creates
The data on each processing node in a CLW cluster is partitioned in time ranges. This creates
advantages at load time and search time. For load time, since event data generally has increasing
time stamps, the likelihood is small of combining new load data with data already loaded. This
time stamps, the likelihood is small of combining new load data with data already loaded. This
reduces data reorganization needs. For search with time constraints, the CLW’s search engine quickly
eliminates the need for scanning data that does not meet the time constraints.
Column-based compression
The CLW uses time-based organization; event data is placed into columnar storage, and then is
The CLW uses time-based organization; event data is placed into columnar storage, and then is
compressed when it is written to disk. High compression ratios are achieved because of the repetitive
nature of event data within a column. Compared to the volume of data stored in an RDBMS database,
the CLW security-event-storage can achieve up to a 40:1 compression ratio. Only the columns
referenced in a search are decompressed and searched. As with time-based organization, this
eliminates the need to decompress and scan large volumes of unnecessary data. The native storage
eliminates the need to decompress and scan large volumes of unnecessary data. The native storage
format of the CLW solution is compressed, with decompression only required after the event data has
been selected based on the time or column references. The basic unit of storage is a flat file, so data
removal and archival operations are simplified and fast.
No indices
Due to the unstructured nature of event data, indices render little value. The CLW provides dramatic
Due to the unstructured nature of event data, indices render little value. The CLW provides dramatic
search response time through distributed parallel searching, and event-data-specific data
organization. This architecture requires no indices. Unlike an RDBMS, the CLW solution does not
need a database administrator to create and drop indices to balance between search and load
need a database administrator to create and drop indices to balance between search and load
performance. There is also no overhead of index maintenance during loading of the CLW database.
This means the event data load rate will remain constant, no matter how much data has already been
loaded. Additionally, because no indices are needed, there is also no need for storage of index
information. It substantially reduces storage requirements as compared to those by a RDBMS-based
SIM products.
SIM products.
Non-transactional model
The CLW delivers unparalleled performance versus RDBMS-based SIM products, largely because of its
The CLW delivers unparalleled performance versus RDBMS-based SIM products, largely because of its
non-transactional model. This is accomplished by minimizing overhead and optimizing use of
computing resources.
computing resources.
No concurrency and locking overhead
As event data is seldom updated, the CLW solution has no RDBMS overhead of row and table
As event data is seldom updated, the CLW solution has no RDBMS overhead of row and table
locking. Searches do not need to wait for updates.
No transactional log
Since the commit/rollback model is not meaningful for event data, the CLW solution avoids CPU, I/O
Since the commit/rollback model is not meaningful for event data, the CLW solution avoids CPU, I/O
and storage capacity overhead required to maintain a transaction log.
14