Snort mailing list archives
mysql database "gone away"
From: David Ryan <David.Ryan () Quintiles com>
Date: Mon, 16 Jul 2007 15:17:02 +0100
I know this has been posted about a few times, but I am still a little lost as to what I can change to stop the database connection going away when there is a network problem or other sort of one-off connectivity issue between the snort sensor and the mysql database it is connecting to.
From what I have read on the topic the problem is a function of the database connectivity model between the client (snort probe) and the mysql server. When the connection drops nothing ever tells the client to re-try the connection. It just says the connection is down, I can't write this data, thank you and goodnight . . .
Obviously it would be nice if some process could be configured to retry this connection and get the data back to the server. What do other people use to get over this problem ? I mean, if you have a connectivity problem into your data centre and you lose connectivty to all your probes, do people really manually log into each remote probe and restart the service ? It just seems a bit . . . manual. I accept that it is a limitation of the mysql client in use, but in practical terms what do people do to ensure the database link doesn't stay down for hours(days/weeks) after a temporary glitch like this ? Thanks, David Hi Greg,
I posted this on the forums a few days ago but since there has been no
replies I am asking anyone on this list for assistance.
Most of my sensors are running on centos 4 without a problem using
mysql and base. To start getting familiar with CentOS 5 i built a test
sensor which comes with mysql 5. I compiled the latest snort 2.6.x version.
What happens if I do not get any alarms is snort loses the connection
and starts throwing various errors like
snort[7890]: database: mysql_error: MySQL server has gone away
The database is working fine. I can still connect to it.
either a timeout happened or the connection was otherwise terminated. The client library of MySQL 4.x did a reconnect whereas this behaviour was changed with version 5.x. Take a look at: http://osdir.com/ml/security.ids.snort.devel/2006-04/msg00001.html Best regards Dirk ********************** IMPORTANT--PLEASE READ ************************ This electronic message, including its attachments, is COMPANY CONFIDENTIAL and may contain PROPRIETARY or LEGALLY PRIVILEGED information. If you are not the intended recipient, you are hereby notified that any use, disclosure, copying, or distribution of this message or any of the information included in it is unauthorized and strictly prohibited. If you have received this message in error, please immediately notify the sender by reply e-mail and permanently delete this message and its attachments, along with any copies thereof. If this electronic message contains a zipped attachment and you do not have a decompression tool, you may download unZIP (free of cost) from: http://www.mk-net-work.com/us/uz/unzip.htm. Alternatively, you may request that the attachment be resent in an uncompressed format. Thank you. ************************************************************************
------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- mysql database "gone away" David Ryan (Jul 16)
- Re: mysql database "gone away" Dirk Geschke (Jul 16)
- Re: mysql database "gone away" Jason Brvenik (Jul 16)
- <Possible follow-ups>
- Re: mysql database "gone away" cconn (Jul 17)