On Tue, Jan 14, 2014 at 11:15 AM, Lawrence Williams <[email protected]> wrote: > > I am trying to get OSSEC 2.7.1 working with my mysql database (all on same > box). > > Ive got the conf file entries: > > <database_output> > <hostname>127.0.0.1</hostname> > <username>ossecuser</username> > <password>ossecpass</password> > <database>ossec</database> > <type>mysql</type> > </database_output> > > but after a couple of minutes i start to see problems with db connection > 'gone away'. The disconnect, issue, reconnect loop then keeps on.... > > I have seen other postings related to similar problems - but none give any > solution. > > 2014/01/14 15:58:09 ossec-dbd(5203): ERROR: Error executing query 'SELECT id > FROM location WHERE name = 'localhost->/var/log/secure' AND server_id = '1' > LIMIT 1'. Error: 'MySQL server has gone away'. > 2014/01/14 15:58:09 ossec-dbd(5209): INFO: Closing connection to database. > 2014/01/14 15:58:09 ossec-dbd(5210): INFO: Attempting to reconnect to > database. > 2014/01/14 15:58:09 ossec-dbd: Connected to database 'ossec' at '127.0.0.1'. > 2014/01/14 16:01:00 ossec-syscheckd: INFO: Initializing real time file > monitoring (not started). > 2014/01/14 16:10:05 ossec-dbd(5203): ERROR: Error executing query 'INSERT > INTO data(id, server_id, user, full_log) VALUES ('8', '1', 'vagrant', 'Jan > 14 16:10:01 localhost sudo: vagrant : TTY=pts/1 ; PWD=/mountlocaldev ; > USER=root ; COMMAND=/bin/su -') '. Error: 'MySQL server has gone away'. > 2014/01/14 16:10:05 ossec-dbd(5209): INFO: Closing connection to database. > 2014/01/14 16:10:05 ossec-dbd(5210): INFO: Attempting to reconnect to > database. > 2014/01/14 16:10:05 ossec-dbd: Connected to database 'ossec' at '127.0.0.1'. > 2014/01/14 16:10:05 ossec-dbd(5204): ERROR: Database error. Unable to run > query. > >
Any errors or interesting entries in you rmysql log? > Any ideas? > TIA > > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
