severity 457792 normal merge 449568 457792 tags 457792 upstream tags 449568 upstream thanks
On Tue, Dec 25, 2007 at 09:15:00PM +0100, Christian Kujau wrote: > I'm using snort-mysql and every now and then snort just isn't running > anymore. There is not entry in snort.log and I still have to run snort > under strace(1) and see if it'll tell me why it exits, but I've run > snort-mysql under valgrind and after 3 days it dumped core (it never > dumped core before): [ I believe this program might be similar to bug report #449568 and I'm merging both bug reports ] The first entry on your snort.log is rather enlightening: Dec 17 23:28:51 sheep snort[32392]: database: mysql_error: MySQL server has gone away (.. more 'has gone away' errors .) Dec 17 23:28:51 sheep snort[32392]: database: mysql_error: MySQL server has gone away SQL=ROLLBACK Dec 17 23:37:13 sheep snort[32392]: *** Caught Term-Signal This might be because there are not many Snort events and the database connection ends up getting severed. You might want to look at http://dev.mysql.com/doc/refman/5.0/en/gone-away.html Notice that you can change the server's wait-timeout variable on mysqld to make connections last longer. I think that the cores it dumps might be related to making it run under valgrind, and unrelated to why you see (on normal runs) snort die now and then. Regards Javier
signature.asc
Description: Digital signature
