Re: Prelude PostgreSQL Support

this may be a compatibility issue between 8.2 and 7.4 although 7.4
should support this quoting style

here is the trac ticket where the change was made
https://trac.prelude-ids.org/changeset/9895

here are the link's to the postgresql site explaining it

http://www.postgresql.org/docs/8.2/interactive/datatype-binary.html
http://www.postgresql.org/docs/7.4/interactive/datatype-binary.html

maybe a change to the code is in order to detect the version of
libpq.so at compile if the version is 5 use the E' ' style quoting if
the version is 4 just use ' ' style quoting

PostgreSQL version 8.2 uses libpq.so.5

PostgreSQL version 7.4 uses libpq.so.4



On Jan 31, 2008 4:01 AM, Ilya Kogan <[email protected]> wrote:
> Hi,
>
>      I'm trying to setup Prelude to use PostgreSQL and am receiving the
> following error:
>
> 31 Jan 01:52:53 (process:32374) WARNING: could not insert message into
> database: ERROR:  type "e" does not exist.
>
> It seems that prelude is trying to execute the following query:
>
> INSERT INTO Prelude_AdditionalData (_parent_type, _message_ident,_index,
> type, meaning, data) VALUES('H', 3, 0, 'string', 'Analyzer status',
> E'starting');
>
> I've been using PostgreSQL for quite a bit but I don't know it nearly as
> well as I'd like so I'm not aware of the particular syntax at
> "E'starting'". My PostgreSQL version is 7.4.19 and I'm using
> prelude-manager 0.9.10. I rebuilt libpreludedb tonight (as it didn't
> have PostgreSQL support) so thats quite new as well. I also created the
> database tonight with the pgsql.sql file and the _format table has
> "14.7" as the version. The error happens as soon as prelude-manager
> starts up as it looks like its trying to record itself starting. If I
> restart a log monitor it starts spewing that error for what seems like
> forever. Heres the startup and query log:
>
> --------- Startup Log -----------
> 31 Jan 02:03:57 (process:408) INFO: Subscribing Normalize to active
> decoding plugins.
> 31 Jan 02:03:57 (process:408) DEBUG: Using configuration file:
> /usr/local/etc/prelude-manager/prelude-manager.conf.
> (prelude-option.c:261 process_cfg_file)
> 31 Jan 02:03:57 (process:408) DEBUG: Using configuration file:
> /usr/local/etc/prelude/default/global.conf. (prelude-option.c:261
> process_cfg_file)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370]
> listen(69.36.2.40) (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] user(prelude)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] group(prelude)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] relaying()
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] db()
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] type(pgsql)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] host(localhost)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] port(5432)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] name(********)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] user(*******)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0] pass(*******)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8067df0]
> log(/var/log/queries.log) (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] textmod()
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x80687c0]
> logfile(/var/log/prelude.log) (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0xbf9ae370] thresholding()
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8068820]
> path(alert.classification.text, alert.source.node.address.address)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8068820] limit(3600)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8068820] count(50)
> (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: [queue=0x8068820]
> hook(relaying[default]) (prelude-option.c:329 call_option_cb)
> 31 Jan 02:03:57 (process:408) DEBUG: group(prelude) context=0x80627e0
> default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: listen(69.36.2.40)
> context=0x80627e0 default=0x80627e0 (prelude-option.c:385
> call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) INFO: server started (listening on
> 69.36.2.40 port 4690).
> 31 Jan 02:03:57 (process:408) DEBUG: user(prelude) context=0x80627e0
> default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: relaying() context=0x80627e0
> default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) INFO: Subscribing Relaying[default] to
> active reporting plugins.
> 31 Jan 02:03:57 (process:408) DEBUG: db() context=0x80627e0
> default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: type(pgsql) context=0x8067e20
> default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: host(localhost) context=0x8067e20
> default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: port(5432) context=0x8067e20
> default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: name(*******) context=0x8067e20
> default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: user(********) context=0x8067e20
> default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: pass(***********) context=0x8067e20
> default=0x8067e20 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: log(/var/log/queries.log)
> context=0x8067e20 default=0x8067e20 (prelude-option.c:385
> call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: commit db (prelude-option.c:398
> call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) INFO: Subscribing db[default] to active
> reporting plugins.
> 31 Jan 02:03:57 (process:408) DEBUG: textmod() context=0x80627e0
> default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: logfile(/var/log/prelude.log)
> context=0x8070c00 default=0x8070c00 (prelude-option.c:385
> call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: commit textmod
> (prelude-option.c:398 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) INFO: Subscribing TextMod[default] to
> active reporting plugins.
> 31 Jan 02:03:57 (process:408) DEBUG: thresholding() context=0x80627e0
> default=0x80627e0 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: path(alert.classification.text,
> alert.source.node.address.address) context=0x80686f8 default=0x80686f8
> (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: limit(3600) context=0x80686f8
> default=0x80686f8 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: count(50) context=0x80686f8
> default=0x80686f8 (prelude-option.c:385 call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) DEBUG: hook(relaying[default])
> context=0x80686f8 default=0x80686f8 (prelude-option.c:385
> call_option_from_cb_list)
> 31 Jan 02:03:57 (process:408) INFO: Subscribing Thresholding to
> filtering plugin with plugin hook Relaying[default].
> 31 Jan 02:03:57 (process:408) DEBUG: filter 'default': match.
> (filter-plugins.c:157 filter_plugins_run_by_plugin)
> 31 Jan 02:03:57 (process:408) WARNING: could not insert message into
> database: ERROR:  type "e" does not exist.
> 31 Jan 02:03:58 (process:408) WARNING: signal 2 received, terminating
> prelude-manager.
> 31 Jan 02:03:58 (process:408) INFO: Waiting queued message to be processed.
> 31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing Relaying[default]
> from active reporting plugins. (report-plugins.c:264 unsubscribe)
> 31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing db[default] from
> active reporting plugins. (report-plugins.c:264 unsubscribe)
> 31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing TextMod[default] from
> active reporting plugins. (report-plugins.c:264 unsubscribe)
> 31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing Normalize from active
> decoding plugins. (decode-plugins.c:61 unsubscribe)
> 31 Jan 02:03:58 (process:408) DEBUG: Unsubscribing Thresholding from
> active reporting plugins. (filter-plugins.c:97 unsubscribe)
>
> ----------- Query Log ------------
> 0.000607s SELECT max(_ident) FROM Prelude_Heartbeat;
> 0.001451s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident,
> _index, analyzerid, name, manufacturer, model, version, class, ostype,
> osversion) VALUES('H', 6, 0, '1981054862469524', 'prelude-manager',
> 'http://www.prelude-ids.com', 'Prelude Manager', '0.9.10',
> 'Concentrator', 'Linux', '2.6.16-xen3_86.1_rhel4.1')
> 0.001189s INSERT INTO Prelude_Node (_parent_type, _message_ident,
> _parent0_index, ident, category, location, name) VALUES('H', 6, 0, NULL,
> 'unknown', 'Columbus', 'MythicNet')
> 0.000665s INSERT INTO Prelude_Process (_parent_type, _message_ident,
> _parent0_index, ident, name, pid, path) VALUES('H', 6, 0, NULL,
> 'prelude-manager', 408, '/usr/local/bin/prelude-manager')
> 0.000493s INSERT INTO Prelude_Analyzer (_parent_type, _message_ident,
> _index, analyzerid, name, manufacturer, model, version, class, ostype,
> osversion) VALUES('H', 6, -1, '1981054862469524', 'prelude-manager',
> 'http://www.prelude-ids.com', 'Prelude Manager', '0.9.10',
> 'Concentrator', 'Linux', '2.6.16-xen3_86.1_rhel4.1')
> 0.000558s INSERT INTO Prelude_Node (_parent_type, _message_ident,
> _parent0_index, ident, category, location, name) VALUES('H', 6, -1,
> NULL, 'unknown', 'Columbus', 'MythicNet')
> 0.000336s INSERT INTO Prelude_Process (_parent_type, _message_ident,
> _parent0_index, ident, name, pid, path) VALUES('H', 6, -1, NULL,
> 'prelude-manager', 408, '/usr/local/bin/prelude-manager')
> 0.001031s INSERT INTO Prelude_CreateTime (_parent_type, _message_ident,
> time, gmtoff, usec) VALUES('H', 6, '2008-01-31 07:03:57', -18000, 253378)
> 0.000729s INSERT INTO Prelude_AdditionalData (_parent_type,
> _message_ident, _index, type, meaning, data) VALUES('H', 6, 0, 'string',
> 'Analyzer status', E'starting')
> 0.000117s ROLLBACK
>
>
> Thanks for your help,
> Ilya Kogan
>
>
>
>
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://www.prelude-ids.org/mailman/listinfo/prelude-user
>
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user