Comments (11)
Will have to look into the more. The date is being pulled from the syslog message. Had previous problems with this. I'll see if I can replicate this with your information. This could also be released (?) to the sagan-rules.c re-write, but I hadn't see anything like this. Will l let you know....
from sagan.
I think it is a threading issue. You can "solve" this if you "serialize" the threads with a "sleep(2)" after
if ( pthread_create( threaddb_id, &thread_db_attr, (void *)sagan_db_thread, &db_args[threadid]) ) {
removelockfile();
sagan_log(1, "[%s, line %d] Error creating database thread.", __FILE__, __LINE__);
}
} else {
sagandrop++;
sagan_log(0, "Snort database thread handler: Out of threads");
}
in sagan.c.
from sagan.
After the "if" ? Hmm. I'm out right now (on vacation) but will look at this a bit later. I don't really like the "sleep(2)" option. Thanks for the help mtg! Will look at it in a bit.
from sagan.
This was not intended as a solution. It should only make the problem
understandable. When using the pthread_join for the db thread, the
problem also occurs not. But it kills the threading, so it is also not
a solution. Have a nice holiday.
from sagan.
Yep and I didnt think you intended it that way :) I realized after at the post that it might come across that way. Never the less, thanks for the information. I'll probably take a look it today/tonight.
from sagan.
mtg: I setup a "sagan-dev" mailing list. While the ticket system is nice, it might be easier for us to talk about specifics off the ticket system. The mailing list is at:
http://mailman.softwink.com/mailman/listinfo/sagan-dev . Just a thought...
from sagan.
Okay.. Sent a possible "fix" into SVN. Did some testing, but it still needs a bit more. Let me know how it works. If this "fixes" the issue, then I'll probably need to update the code in a few more places. Thanks.
from sagan.
Went ahead and updated the code in the places I was thinking about. Hopefully this fixes that thread issue. Let me know how it goes.
from sagan.
I've testet the code from yesterday. It takes a little longer but the bug is still there.
[*] [output-plugins/sagan-snort.c, line 215] PostgreSQL Error: ERROR: invalid input syntax for type timestamp with time zone: " 1:06"
[E] DB Query failed: INSERT INTO event(sid, cid, signature, timestamp) VALUES ('2', '604', '4', ' 1:06')
I'll try the current svn code now and mail the result to the dev list.
from sagan.
Minor change to PostgreSQL code which might help. You can also run Sagan with the '--devdebug' flag to see SQL statements just before they happen.
from sagan.
I'm calling this one "closed". Please re-open if you don't think it's completely resolved. Looks fine from my end, but who knows. :)
from sagan.
Related Issues (20)
- Rule parsing silently allows unrecognised conditions HOT 2
- syslog facility conditions are not parsed or honoured
- Documentation/purpose of "date" and "time" fields
- sagan silently changes ownership of fifo HOT 4
- Document purpose of "hostname" field HOT 1
- Extra space added to JSON is neutering liblognorm rules
- Default pidfile/lockfile location is on tmpfs HOT 9
- Spurious detection of nested JSON HOT 2
- Trim trailing space? HOT 5
- journald/journalctl integration HOT 4
- A couple of input-json issues HOT 2
- Inconsistent max syslog_tag length settings and tmpbuf length HOT 2
- [Question] Configure Sagan HOT 1
- Sagan says there is an issue with IP addresses but it works.. HOT 2
- Flexbits "IsNotSet" with name starting with a space is not recognized correctly
- Scope flexbits to usernames HOT 2
- Compilation failure in src/config-yaml.c HOT 1
- External program not executing. HOT 2
- THIS REPO HAS MOVED TO https://github.com/quadrantsec/sagan !
- Error with variables for alert_time keyword HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sagan.