Project

General

Profile

Actions

Bug #6857

closed

Search hosts view generates too broad database queries

Added by Radko Krkoš over 3 years ago. Updated about 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
Design
Target version:
Start date:
01/05/2021
Due date:
% Done:

0%

Estimated time:
To be discussed:
No

Description

The Hosts tab in Mentat corresponding to the Search hosts view leads to a database query that is too broad and wastes system resources (and takes too long to execute).
The view allows to display results for a single IP address, yet it generates a DB query such as:

SELECT * FROM events AS "_mentatq(83_eaedjv)_" INNER JOIN events_json USING(id) WHERE "detecttime" >= '2020-12-29T12:00:00+00:00'::timestamptz AND "detecttime" <= '2021-01-05T12:00:00+00:00'::timestamptz

The scope of the query could be decreased, from at least two angles:
1. The returned data set could be filtered to only contain events related to the IP queried.
2. Returning all metadata columns JOINed by the JSON document is redundant, most of the data is read, formatted and transferred, but not processed afterwards.


Related issues

Related to Mentat - Feature #6926: Replace Hosts by TimelineClosedPavel Kácha01/13/2021

Actions
Actions

Also available in: Atom PDF