Fatal Error Database Mysql_error Duplicate Entry
Note that connection 47 is still connected... Nothing to install. Is barnyard2.conf as follows a cause? Each instance Need its own configuration file that will differentiate each instance especialy if you log to a database. More hints
From: John Ives
Read 4 records At the same time I was checking for the processes (only one is running... Read 3 records
Welcome, Guest. But duplicate entry occurred by restarting Snort Barnyard2 same as before. I've got only one snort instance and fresh database for barnyard2. https://forum.pfsense.org/index.php?topic=75357.0 Oct 25 15:51:46 ids barnyard2:suricata: Barnyard2 exiting Collaborator binf commented Oct 25, 2013 On Fri, Oct 25, 2013 at 3:10 AM, s-takehana [email protected] wrote: I've updated to bug-fix-release and tried it.
barnyard2 needs to be updated but that is out of scope from the pfsense project.. Which step did you take, etc... Seem's like your ither using MyIASM or running two by2 instance with the same sid and obviously it violate the PK integrity check. you definitely do not want more than one instance using the same PID file...
However, I have not been >> able to make it work as all but one of the barnyards will >> eventually crash. > > Could you define crash? What's basic causes of this issue? Which step did you take, etc... s-takehana commented Oct 18, 2013 cat /var/log/messages | grep "Duplicate entry" Oct 16 03:32:06 ids barnyard2:suricata: ERROR: database mysql_error: Duplicate entry '732-2' for key 'PRIMARY' Oct 17 03:32:07 ids barnyard2:suricata: ERROR:
However, in the interim there is a parameter that can be included on the configuration line for the DB output plugin that disables updates to the signature references table. this contact form s-takehana closed this Sep 9, 2013 s-takehana reopened this Oct 18, 2013 s-takehana commented Oct 18, 2013 Hi @binf, I've deleted every row in sig_reference table. Please keep mailing list traffic on the list unless private contact is specifically requested and granted. DELETE FROM sig_reference WHERE sig_id='732' AND ref_id = '65615' Oct 18 17:12:23 ids barnyard2:suricata: ERROR: database mysql_error: Duplicate entry '634-3' for key 'PRIMARY' mysql> SELECT * FROM sig_reference WHERE sig_id =
I did a quick look in the > configuration, but I didn't see what option is used to differentiate > the instances, so I suspect this is the root of my There shouldn't be any issue running ET and VRT together on a same db. If you log to syslog for example you can use only one configuration and spawn each by2 process with a script loop. >Supposedly, that is all that is needed. > However, have a peek here I was having issues just like users have reported here on the Forum, and running the scripts in the first link above fixed them.Bill « Last Edit: April 15, 2014, 07:14:32
We recommend upgrading to the latest Safari, Google Chrome, or Firefox. Terms Privacy Opt Out Choices Advertise Get latest updates about Open Source Projects, Conferences and News. but then suddenly another Connect arrives (48) which basically does the same queries once again.
Hit send before proof reading my self, by "extract historical iteration out of it" i mean identify which rule would have changed and most probably with added/swaped references.
All instances crash with the same error. All Rights Reserved. MySQL database storage is InnoDB. Start by2 in console and you will not have the issue, then fix your startup script.
Did you clear the entries in sig_reference before testing the test branch? Here are two links to post on the web that can help you fix this problem if you have it.This is the one I recommend you try first --http://sourceforge.net/p/snort/mailman/message/31925851/Here is another on the eth0 interface, it is snort_eth0.pid... Check This Out mabey if you do the same exercise as previously to see which signature is conflicting and how they are described in their respective sid-msg.map file this could give more insight? -elz
Read 3 records cool-ids# What is happening? Re: [Snort-users] Barnyard2 issue w/unified2 ? Barnyard2 exiting I've resolved the error by deleting duplicate records. I've followed all the instructions here and yet I'm still having the problem.
barnyard2 config: cool-ids# egrep -v '^$|^#' /usr/local/barnyard2-1.13/etc/barnyard2.conf config reference_file: /usr/local/etc/snort/reference.config config classification_file: /usr/local/etc/snort/classification.config config gen_file: /usr/local/etc/snort/gen-msg.map config sid_file: /usr/local/etc/snort/sid-msg.map config hostname: cool-ids config interface: dmz2 config alert_with_interface_name config process_new_records_only input unified2 Suricata Barnyard2 is using sid-msg.map of ET PRO ruleset. As a result, I don't remember exactly what the error said. Nothing to install.
one major thing to note in the cases of running multiple instances of a program is the PID file they use... i have attempted to set up a multiple detection configuration with a well known appliance package but had to withdraw when it stated that 1Gig of RAM per instance was needed I've also tried to clear sig_reference and delete only duplicate entry.