Looks like it's a quoting problem within the MySQL syntax... you may need to patch BASE to correctly deal with "data_payloads" that contain quotes; single-quotes in this particular case. ________________________________________ From: [email protected] [[email protected]] On Behalf Of sec0ps [[email protected]] Sent: Tuesday, September 29, 2009 11:17 To: ossec-list Subject: [ossec-list] OSSEC -> BASE -> Archive
Does anyone have a solution for moving events from BASE to the BASE archive. I currently have events going into the db I have setup for snort and ossec, when I try to move ossec events to the archive database I get the following error message: Archive error:Database ERROR:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Host-based anomaly detection event (rootcheck).' Src IP: (0.0.0.0) User: (none) ' at line 1 INSERT INTO data (sid,cid, data_payload) VALUES (40, 67653, '** Alert 1254234795.65673781: mail - ossec,rootcheck, 2009 Sep 29 10:33:15 webtest -> rootcheck Rule: 510 (level 7) -> 'Host-based anomaly detection event (rootcheck).' Src IP: (0.0.0.0) User: (none) File '/ var/log/acpid' is owned by root and has written permissions to anyone.') /var/www/html/base/includes/base_action.inc.php:1667: Archive error:: Not everything seems to have been written to the archive db: $sql_cnt = 3 $archive_cnt = 2 Ignored 1 duplicate alert(s) No alerts were selected or the Archive alert(s) (move) was not successful The primary database is snort, the archive being snort_archive, both have the exact same structure.
