Re: Barnyard2 reports database insert errors

[beenph <beenph () gmail com>]

On Fri, Nov 1, 2013 at 11:58 AM, Dave Corsello
<snort-users () wintertreemedia com> wrote:
> Folks,
Hi Dave,

> I asked about this a long time ago, and just recently looked at the
> problem again.  I'm not sure if it's a barnyard2 problem, a MySQL
> problem, or a problem with some other component.
>
> I'm getting intermittent errors similar to the following:
>
> Nov 1 10:25:14 snort2 barnyard2[XXXXX]: [Database()]: Insertion of Query
> [INSERT INTO event (sid,cid,signature,timestamp) VALUES (X, XXXXXX,
> XXXXXX, '2013-11-01 10:25:09');] failed

1. Which version of barnyard2 are you using?
2. If you say that the record is there, then its normal that you get
this error because
    you can't have a record with the same sid(sensor id),cid(incident
id) inserted.

Would it be possible that you might have two barnyard2 process using
the same configuration and processing the same spool file logging to
the same database?
wrong startup script  for example.

Which storage engine are you using with MySQL?
Could you return the result of the following query:
      SELECT table_name,engine FROM INFORMATION_SCHEMA.TABLES WHERE
table_schema=DATABASE();



> But when I check the database, the record is there.  So, either a status
> message is not making it from MySQL to barnyard2, or barnyard2 is
> dropping the ball somehow.  The database resides on another machine.
> Traffic between the snort/barnyard2 machine and the MySQL machine is
> open on port 3306.
>
> Any ideas?

-elz

------------------------------------------------------------------------------
Android is increasing in popularity, but the open development platform that
developers love is also attractive to malware creators. Download this white
paper to learn more about secure code signing practices that can help keep
Android apps secure.
http://pubads.g.doubleclick.net/gampad/clk?id=65839951&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!