Prelude PostgreSQL Support

Hi,

     I'm trying to setup Prelude to use PostgreSQL and am receiving the
following error:

31 Jan 01:52:53 (process:32374) WARNING: could not insert message into
database: ERROR:  type "e" does not exist.

It seems that prelude is trying to execute the following query:

INSERT INTO Prelude_AdditionalData (_parent_type, _message_ident,_index, 
type, meaning, data) VALUES('H', 3, 0, 'string', 'Analyzer status', 
E'starting');

I've been using PostgreSQL for quite a bit but I don't know it nearly as
well as I'd like so I'm not aware of the particular syntax at
"E'starting'". My PostgreSQL version is 7.4.19 and I'm using
prelude-manager 0.9.10. I rebuilt libpreludedb tonight (as it didn't
have PostgreSQL support) so thats quite new as well. I also created the
database tonight with the pgsql.sql file and the _format table has
"14.7" as the version. The error happens as soon as prelude-manager
starts up as it looks like its trying to record itself starting. If I
restart a log monitor it starts spewing that error for what seems like
forever. Heres the startup and query log:

--------- Startup Log -----------
31 Jan 02:03:57 (process:408) INFO: Subscribing Normalize to active
decoding plugins.
31 Jan 02:03:57 (process:408) DEBUG: Using configuration file:
/usr/local/etc/prelude-manager/prelude-manager.conf.
(prelude-option.c:261 process_cfg_file)
31 Jan 02:03:57 (process:408) DEBUG: Using configuration file:
/usr/local/etc/prelude/default/global.conf. (prelude-option.c:261
process_cfg_file)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370]
listen(69.36.2.40) (prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] user(prelude)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] group(prelude)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] relaying()
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] db()
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] type(pgsql)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] host(localhost)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] port(5432)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] name(********)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] user(*******)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] pass(*******)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0]
log(/var/log/queries.log) (prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] textmod()
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x80687c0]
logfile(/var/log/prelude.log) (prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] thresholding()
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8068820]
path(alert.classification.text, alert.source.node.address.address)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8068820] limit(3600)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8068820] count(50)
(prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8068820]
hook(relaying[default]) (prelude-option.c:329 call_option_cb)
31 Jan 02:03:57 (process:408) DEBUG: group(prelude) context=0x80627e0
default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: listen(69.36.2.40)
context=0x80627e0 default=0x80627e0 (prelude-option.c:385
call_option_from_cb_list)
31 Jan 02:03:57 (process:408) INFO: server started (listening on
69.36.2.40 port 4690).
31 Jan 02:03:57 (process:408) DEBUG: user(prelude) context=0x80627e0
default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: relaying() context=0x80627e0
default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) INFO: Subscribing Relaying[default] to
active reporting plugins.
31 Jan 02:03:57 (process:408) DEBUG: db() context=0x80627e0
default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: type(pgsql) context=0x8067e20
default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: host(localhost) context=0x8067e20
default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: port(5432) context=0x8067e20
default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: name(*******) context=0x8067e20
default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: user(********) context=0x8067e20
default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: pass(***********) context=0x8067e20
default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: log(/var/log/queries.log)
context=0x8067e20 default=0x8067e20 (prelude-option.c:385
call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: commit db (prelude-option.c:398
call_option_from_cb_list)
31 Jan 02:03:57 (process:408) INFO: Subscribing db[default] to active
reporting plugins.
31 Jan 02:03:57 (process:408) DEBUG: textmod() context=0x80627e0
default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: logfile(/var/log/prelude.log)
context=0x8070c00 default=0x8070c00 (prelude-option.c:385
call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: commit textmod
(prelude-option.c:398 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) INFO: Subscribing TextMod[default] to
active reporting plugins.
31 Jan 02:03:57 (process:408) DEBUG: thresholding() context=0x80627e0
default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: path(alert.classification.text,
alert.source.node.address.address) context=0x80686f8 default=0x80686f8
(prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: limit(3600) context=0x80686f8
default=0x80686f8 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: count(50) context=0x80686f8
default=0x80686f8 (prelude-option.c:385 call_option_from_cb_list)
31 Jan 02:03:57 (process:408) DEBUG: hook(relaying[default])
context=0x80686f8 default=0x80686f8 (prelude-option.c:385
call_option_from_cb_list)
31 Jan 02:03:57 (process:408) INFO: Subscribing Thresholding to
filtering plugin with plugin hook Relaying[default].
31 Jan 02:03:57 (process:408) DEBUG: filter 'default': match.
(filter-plugins.c:157 filter_plugins_run_by_plugin)
31 Jan 02:03:57 (process:408) WARNING: could not insert message into
database: ERROR:  type "e" does not exist.
31 Jan 02:03:58 (process:408) WARNING: signal 2 received, terminating
prelude-manager.
31 Jan 02:03:58 (process:408) INFO: Waiting queued message to be processed.
31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing Relaying[default]
from active reporting plugins. (report-plugins.c:264 unsubscribe)
31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing db[default] from
active reporting plugins. (report-plugins.c:264 unsubscribe)
31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing TextMod[default] from
active reporting plugins. (report-plugins.c:264 unsubscribe)
31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing Normalize from active
decoding plugins. (decode-plugins.c:61 unsubscribe)
31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing Thresholding from
active reporting plugins. (filter-plugins.c:97 unsubscribe)

----------- Query Log ------------
0.000607s SELECT max(_ident) FROM Prelude_Heartbeat;
0.001451s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, 
_index, analyzerid, name, manufacturer, model, version, class, ostype, 
osversion) VALUES('H', 6, 0, '1981054862469524', 'prelude-manager', 
'http://www.prelude-ids.com', 'Prelude Manager', '0.9.10', 
'Concentrator', 'Linux', '2.6.16-xen3_86.1_rhel4.1')
0.001189s INSERT INTO Prelude_Node (_parent_type, _message_ident, 
_parent0_index, ident, category, location, name) VALUES('H', 6, 0, NULL, 
'unknown', 'Columbus', 'MythicNet')
0.000665s INSERT INTO Prelude_Process (_parent_type, _message_ident, 
_parent0_index, ident, name, pid, path) VALUES('H', 6, 0, NULL, 
'prelude-manager', 408, '/usr/local/bin/prelude-manager')
0.000493s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident, 
_index, analyzerid, name, manufacturer, model, version, class, ostype, 
osversion) VALUES('H', 6, -1, '1981054862469524', 'prelude-manager', 
'http://www.prelude-ids.com', 'Prelude Manager', '0.9.10', 
'Concentrator', 'Linux', '2.6.16-xen3_86.1_rhel4.1')
0.000558s INSERT INTO Prelude_Node (_parent_type, _message_ident, 
_parent0_index, ident, category, location, name) VALUES('H', 6, -1, 
NULL, 'unknown', 'Columbus', 'MythicNet')
0.000336s INSERT INTO Prelude_Process (_parent_type, _message_ident, 
_parent0_index, ident, name, pid, path) VALUES('H', 6, -1, NULL, 
'prelude-manager', 408, '/usr/local/bin/prelude-manager')
0.001031s INSERT INTO Prelude_CreateTime (_parent_type, _message_ident, 
time, gmtoff, usec) VALUES('H', 6, '2008-01-31 07:03:57', -18000, 253378)
0.000729s INSERT INTO Prelude_AdditionalData (_parent_type, 
_message_ident, _index, type, meaning, data) VALUES('H', 6, 0, 'string', 
'Analyzer status', E'starting')
0.000117s ROLLBACK


Thanks for your help,
Ilya Kogan

_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkehjlYACgkQWz8XsrBu928aEgCgqpSq+zYDdzfzu5kkYe5lhA2a
WSYAoL/3noYJfVrdMkmxLwHl5f6Mt0gN
=OM9j
-----END PGP SIGNATURE-----