Home > Fatal Error > Fatal Error Database Mysql_error Duplicate Entry

Fatal Error Database Mysql_error Duplicate Entry

I have started up the system/snorts/barnyards that I was testing this on and have launched it so I will see what I can find. Please refer to our Privacy Policy or Contact Us for more details You seem to have CSS turned off. Oct 25 15:44:02 ids barnyard2:snort[28591]: Barnyard2 exiting Oct 25 15:45:12 ids barnyard2:suricata[3873]: INFO database: Defaulting Reconnect/Transaction Error limit to 10 Oct 25 15:45:12 ids barnyard2:suricata[3873]: INFO database: Defaulting Reconnect sleep time s-takehana commented Oct 23, 2013 Thank you for answering. Source

Note that connection 47 is still connected... Nothing to install. Is barnyard2.conf as follows a cause? Each instance Need its own configuration file that will differentiate each instance especialy if you log to a database. More hints

From: John Ives - 2013-08-15 22:37:49 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 8/15/2013 1:59 PM, waldo kitty wrote: > On 8/15/2013 13:50, John Ives wrote: >> Trying to output I've tried to delete only duplicate entry or update reference tag while referring to your help. As a result, failures occurred in both Snort Barnyard2 and Suricata Barnyard2. Oct 25 15:51:46 ids barnyard2:suricata[3873]: Barnyard2 exiting Can you extract info for this signature as you did before?

Read 4 records At the same time I was checking for the processes (only one is running... Read 3 records


What is happening? UPDATE reference SET ref_tag='blog.sipvicious.org/' WHERE ref_id='65615' AND ref_system_id='5'; So I've executed below SQL too, then other duplicate entry was detected. From: Weir, Jason - 2013-08-13 23:06:53 Attachments: Message as HTML I've experienced this issue when I mistakenly start a second barnyard process without killing the original first.

Welcome, Guest. But duplicate entry occurred by restarting Snort Barnyard2 same as before. I've got only one snort instance and fresh database for barnyard2. https://forum.pfsense.org/index.php?topic=75357.0 Oct 25 15:51:46 ids barnyard2:suricata[3873]: Barnyard2 exiting Collaborator binf commented Oct 25, 2013 On Fri, Oct 25, 2013 at 3:10 AM, s-takehana [email protected] wrote: I've updated to bug-fix-release and tried it.

barnyard2 needs to be updated but that is out of scope from the pfsense project.. Which step did you take, etc... Seem's like your ither using MyIASM or running two by2 instance with the same sid and obviously it violate the PK integrity check. you definitely do not want more than one instance using the same PID file...

However, I have not been >> able to make it work as all but one of the barnyards will >> eventually crash. > > Could you define crash? What's basic causes of this issue? Which step did you take, etc... s-takehana commented Oct 18, 2013 cat /var/log/messages | grep "Duplicate entry" Oct 16 03:32:06 ids barnyard2:suricata[31764]: ERROR: database mysql_error: Duplicate entry '732-2' for key 'PRIMARY' Oct 17 03:32:07 ids barnyard2:suricata[1247]: ERROR:

However, in the interim there is a parameter that can be included on the configuration line for the DB output plugin that disables updates to the signature references table. this contact form s-takehana closed this Sep 9, 2013 s-takehana reopened this Oct 18, 2013 s-takehana commented Oct 18, 2013 Hi @binf, I've deleted every row in sig_reference table. Please keep mailing list traffic on the list unless private contact is specifically requested and granted. DELETE FROM sig_reference WHERE sig_id='732' AND ref_id = '65615' Oct 18 17:12:23 ids barnyard2:suricata[20417]: ERROR: database mysql_error: Duplicate entry '634-3' for key 'PRIMARY' mysql> SELECT * FROM sig_reference WHERE sig_id =

I did a quick look in the > configuration, but I didn't see what option is used to differentiate > the instances, so I suspect this is the root of my There shouldn't be any issue running ET and VRT together on a same db. If you log to syslog for example you can use only one configuration and spawn each by2 process with a script loop. >Supposedly, that is all that is needed. > However, have a peek here I was having issues just like users have reported here on the Forum, and running the scripts in the first link above fixed them.Bill « Last Edit: April 15, 2014, 07:14:32

We recommend upgrading to the latest Safari, Google Chrome, or Firefox. Terms Privacy Opt Out Choices Advertise Get latest updates about Open Source Projects, Conferences and News. but then suddenly another Connect arrives (48) which basically does the same queries once again.

Hit send before proof reading my self, by "extract historical iteration out of it" i mean identify which rule would have changed and most probably with added/swaped references.

All instances crash with the same error. All Rights Reserved. MySQL database storage is InnoDB. Start by2 in console and you will not have the issue, then fix your startup script.

Did you clear the entries in sig_reference before testing the test branch? Here are two links to post on the web that can help you fix this problem if you have it.This is the one I recommend you try first --http://sourceforge.net/p/snort/mailman/message/31925851/Here is another on the eth0 interface, it is snort_eth0.pid... Check This Out mabey if you do the same exercise as previously to see which signature is conflicting and how they are described in their respective sid-msg.map file this could give more insight? -elz

Read 3 records cool-ids# What is happening? Re: [Snort-users] Barnyard2 issue w/unified2 ? Barnyard2 exiting I've resolved the error by deleting duplicate records. I've followed all the instructions here and yet I'm still having the problem.

barnyard2 config: cool-ids# egrep -v '^$|^#' /usr/local/barnyard2-1.13/etc/barnyard2.conf config reference_file: /usr/local/etc/snort/reference.config config classification_file: /usr/local/etc/snort/classification.config config gen_file: /usr/local/etc/snort/gen-msg.map config sid_file: /usr/local/etc/snort/sid-msg.map config hostname: cool-ids config interface: dmz2 config alert_with_interface_name config process_new_records_only input unified2 Suricata Barnyard2 is using sid-msg.map of ET PRO ruleset. As a result, I don't remember exactly what the error said. Nothing to install.

one major thing to note in the cases of running multiple instances of a program is the PID file they use... i have attempted to set up a multiple detection configuration with a well known appliance package but had to withdraw when it stated that 1Gig of RAM per instance was needed I've also tried to clear sig_reference and delete only duplicate entry.