[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-users
Subject:    [Snort-users] Barnyard2 Problem
From:       Jim Campbell via Snort-users <snort-users () lists ! snort ! org>
Date:       2020-03-21 17:35:27
Message-ID: f9867914-6fa5-e116-b964-bd50f1ad951c () w4bqp ! net
[Download RAW message or body]

I realize that this isn't the Barnyard2 list. I haven't had much luck 
posting there in the past. Perhaps someone on this list has experienced 
the same problem and can offer some insight.

My problem is occurring randomly every few weeks. When it happens this 
is the output I see when starting Barnyard2:

...
Barnyard2 spooler: Event cache size set to [2048]
Log directory = /var/log/barnyard2
INFO database: Defaulting Reconnect/Transaction Error limit to 10
INFO database: Defaulting Reconnect sleep time to 5 second
ERROR: database mysql_error: Duplicate entry '42926-2' for key 'PRIMARY'
                 SQL=[INSERT INTO sig_reference (ref_id,sig_id,ref_seq) 
VALUES ('44926','42926','2');]
Fatal Error, Quitting..
Barnyard2 exiting
...

Barnyard2 is attempting to insert a record into the sig_reference table 
and the sig_reference table already has that record. What is causing 
Barnyard2 to do this? I haven't changed anything.

I've tried deleting that record from the sig_reference table but when I 
restart Barnyard2 it tries to insert a different record.

The only way that I have found to get out of this situation is to drop 
the "snort" table from the MySQL database and recreating it with "source 
~/snort_src/barnyard2-master/schemas/create_mysql". After some grumbles 
about missing information Barnyard2 sorts things out and begins to run 
again as if nothing had happened.

Is there a better way to handle this situation? Any help would be much 
appreciated.

Jim Campbell

_______________________________________________
Snort-users mailing list
Snort-users@lists.snort.org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	snort-users-leave@lists.snort.org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

[prev in list] [next in list] [prev in thread] [next in thread]