Hello,
I just compiled in support for mysql with OSSEC. For some reason, just
after loading all the .xml rules files, OSSEC
stops talking to mysql.
2008/01/18 13:30:07 ossec-dbd: Connected to database 'ossec' at 'x.x.x.x'.
OSSEC connects just fine.
Here is some debug output:
2008/01/18 13:21:52 ossec-dbd: DEBUG: read xml for rule
'/rules/local_rules.xml'.
2008/01/18 13:21:52 ossec-dbd: DEBUG: XML Variables applied.
2008/01/18 13:21:52 ossec-dbd: DEBUG: entering _Rules_ReadInsertDB()
<--- Above line repeated about 50 times -->
The local_rules.xml file is the last file loaded into the database, and
after that nothing else gets added and ossec-dbd dies.
Here is some mysql debug, if it's helpful.
080118 13:36:47 32 Connect [EMAIL PROTECTED] on
32 Query SELECT VERSION()
32 Query SET NAMES utf8
32 Query SET collation_connection =
'utf8_unicode_ci'
32 Query SET NAMES utf8
32 Query SET collation_connection =
'utf8_unicode_ci'
32 Query SHOW SESSION VARIABLES LIKE
'collation_connection'
32 Query SHOW SESSION VARIABLES LIKE
'character_set_connection'
32 Query SHOW CHARACTER SET
32 Query SHOW COLLATION
32 Init DB ossec
32 Query SHOW TABLES LIKE
'signature_category_mapping'
32 Init DB ossec
32 Query SHOW TABLE STATUS LIKE
'signature_category_mapping'
32 Query SHOW INDEX FROM
`signature_category_mapping`
32 Query SHOW FULL FIELDS FROM
`signature_category_mapping`
32 Query SHOW CREATE TABLE
`ossec`.`signature_category_mapping`
32 Query SHOW FULL COLUMNS
FROM `ossec`.`signature_category_mapping`
32 Quit
080118 13:49:50 9 Quit
Nothing jumps out at me, but maybe someone on the list might have an
idea. I have around 20 hosts logging to OSSEC, a few which are fairly
busy due to ftp and http servers.
-Reggie
