[Prelude Hybrid IDS] #145: prelude-manager trying to input text into bytea fields and failing
Prelude Hybrid IDS <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#145: prelude-manager trying to input text into bytea fields and failing ------------------------------------+--------------------------------------- Reporter: [email protected] | Owner: yoann Type: defect | Status: new Priority: high | Milestone: Component: generic | Version: 0.9 Severity: normal | Keywords: bytea additional_data ------------------------------------+--------------------------------------- I found weird messages in my logs like this: prelude-manager: could not insert message into database: Query error: ERROR: invalid input syntax for type bytea . I did some investigating, and these log entries are happening every time one of my prelude-lml entries derived from ntsyslog comes in. Here's a dump from the manager's debug output: additional_data(0): type: string (0) meaning: Log received from data: /var/log/winmessages additional_data(1): type: string (0) meaning: Original Log data: Apr 17 00:26:35 123.123.123.123 security[failure] 681 NT AUTHORITY\SYSTEM The logon to account: Administrator by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 from workstation: HOST-NAME failed. The error code was: 3221225578 could not insert message into database: Query error: ERROR: invalid input syntax for type bytea . In the database, prelude_additionaldata's data field is indeed bytea! A cursory googling for this shows that we need to be using PQescapeBytea for this type of field.. Can someone fix this? -- Ticket URL: <https://trac.prelude-ids.org/ticket/145> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel