sagan logs the wrong rule about sagan HOT 11 CLOSED

Will have to look into the more. The date is being pulled from the syslog message. Had previous problems with this. I'll see if I can replicate this with your information. This could also be released (?) to the sagan-rules.c re-write, but I hadn't see anything like this. Will l let you know....

from sagan.

I think it is a threading issue. You can "solve" this if you "serialize" the threads with a "sleep(2)" after

           if ( pthread_create( threaddb_id, &thread_db_attr, (void *)sagan_db_thread, &db_args[threadid]) ) { 
                removelockfile();
                sagan_log(1, "[%s, line %d] Error creating database thread.", __FILE__, __LINE__);
                }

                } else { 

                sagandrop++;
                sagan_log(0, "Snort database thread handler: Out of threads");
            }

in sagan.c.

from sagan.

After the "if" ? Hmm. I'm out right now (on vacation) but will look at this a bit later. I don't really like the "sleep(2)" option. Thanks for the help mtg! Will look at it in a bit.

from sagan.

This was not intended as a solution. It should only make the problem
understandable. When using the pthread_join for the db thread, the
problem also occurs not. But it kills the threading, so it is also not
a solution. Have a nice holiday.

from sagan.

Yep and I didnt think you intended it that way :) I realized after at the post that it might come across that way. Never the less, thanks for the information. I'll probably take a look it today/tonight.

from sagan.

mtg: I setup a "sagan-dev" mailing list. While the ticket system is nice, it might be easier for us to talk about specifics off the ticket system. The mailing list is at:
http://mailman.softwink.com/mailman/listinfo/sagan-dev . Just a thought...

from sagan.

Okay.. Sent a possible "fix" into SVN. Did some testing, but it still needs a bit more. Let me know how it works. If this "fixes" the issue, then I'll probably need to update the code in a few more places. Thanks.

from sagan.

Went ahead and updated the code in the places I was thinking about. Hopefully this fixes that thread issue. Let me know how it goes.

from sagan.

I've testet the code from yesterday. It takes a little longer but the bug is still there.

 [*] [output-plugins/sagan-snort.c, line 215] PostgreSQL Error: ERROR:  invalid input syntax for type timestamp with time zone: " 1:06"
 [E] DB Query failed: INSERT INTO event(sid, cid, signature, timestamp) VALUES ('2', '604', '4', ' 1:06')

I'll try the current svn code now and mail the result to the dev list.

from sagan.

Minor change to PostgreSQL code which might help. You can also run Sagan with the '--devdebug' flag to see SQL statements just before they happen.

from sagan.

I'm calling this one "closed". Please re-open if you don't think it's completely resolved. Looks fine from my end, but who knows. :)

from sagan.