Hi,
i do not see any error in the MySQL-logs.
Today the problem reoccurs, ossec-dbd was still running but lost connection to
the DB.
Error message was the same:
2010/07/22 10:08:59 ossec-dbd(5203): ERROR: Error executing query 'SELECT id
FROM location WHERE name = 'sles11
-sp1-vm1-kus->/var/log/messages' AND server_id = '1' LIMIT 1'. Error: 'MySQL
server has gone away'.
The MySQL-DB was still up and running, also a restart of the MySQL-DB does not
helped.
I was able to look with strace to the already running ossec-dbd:
ossecm 459 1 0 Jul20 ? 00:00:02 /var/ossec/bin/ossec-dbd
root 18432 18224 0 10:11 pts/0 00:00:00 grep dbd
sles11-sp1-vm1-kus:~ # strace -p 459
Process 459 attached - interrupt to quit
select(0, NULL, NULL, NULL, {0, 815112}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
stat("/etc/localtime", {st_mode=S_IFREG|0555, st_size=2309, ...}) = 0
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
stat("/etc/localtime", {st_mode=S_IFREG|0555, st_size=2309, ...}) = 0
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "** Alert 1279786370.333: - syslo"..., 4096) = 335
poll([{fd=4, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
write(4, "i\0\0\0\3SELECT id FROM location WHE"..., 109) = 109
read(4, "\1\0\0\1\1/\0\0\2\3def\5ossec\10location\10loc"..., 16384) = 80
poll([{fd=4, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
write(4, "\316\0\0\0\3INSERT INTO data(id, server"..., 210) = 210
read(4, "\7\0\0\1\0\1\0\2\0\0\0", 16384) = 11
poll([{fd=4, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
write(4, "\201\0\0\0\3INSERT INTO alert(id,server"..., 133) = 133
read(4, "\7\0\0\1\0\1\0\2\0\0\0", 16384) = 11
stat("/etc/localtime", {st_mode=S_IFREG|0555, st_size=2309, ...}) = 0
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
stat("/etc/localtime", {st_mode=S_IFREG|0555, st_size=2309, ...}) = 0
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
stat("/etc/localtime", {st_mode=S_IFREG|0555, st_size=2309, ...}) = 0
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
stat("/etc/localtime", {st_mode=S_IFREG|0555, st_size=2309, ...}) = 0
read(5, "", 4096) = 0
select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
read(5, "", 4096) = 0
Seems to be a timeout problem with ossec-dbd.
After restarting ossec everything is working again.
Any ideas?
Regards,
Kai-Uwe
