Many snort.conf files and configuration guides still insist on using output database. Not using Barnyard can be a real performance killer. Barnyard reads the output and takes care of the inserts to the DB. Snort is not multi-threaded. If your database inserts are slower than the ability of Snort to keep up with packet processing, you will drop packets. Barnyard and other spool readers make a huge difference. Snort writes its output to disk. Decoupling that process allows it to run as fast as possible.”]
Source: https://taosecurity.blogspot.com/2005/06/bleeding-snort-starts-snort.html