Snort mailing list archives
Re: Barnyard2 DB error and it will not start
From: elof () sentor se
Date: Fri, 10 Jul 2015 14:14:40 +0200 (CEST)
Hi Avery! Yes, this is a confusing/misleading error message. Since the cache sync is performed within a transaction, the duplicate insert will never actually happen. So, you seem to already have metadata populated in the DB, while the sync tries to add more/other data to some reference. Your problem might disappear if you run these commands, to find dupes and remove them: DELETE FROM signature where sig_id NOT IN ( select min(dup.sig_id) from signature dup group by sig_sid,sig_gid,sig_rev); DELETE FROM reference_system where ref_system_id NOT IN ( select min(dup.ref_system_id) from reference_system dup group by ref_system_name); DELETE FROM sig_class where sig_class_id NOT IN ( select min(dup.sig_class_id) from sig_class dup group by sig_class_name); DELETE FROM reference where ref_id NOT IN ( select min(dup.ref_id) from reference dup group by ref_system_id,ref_tag); ...but I think not. I guess you don't have dupes, but conflicting data in the DB vs what is in your new snort.conf rules. So if the above don't work, I would reset the entire metadata system and let by2 re-populate it from scratch. Note: old events will no longer show correct references. Here's an example for Postgres: DELETE FROM public.reference; DELETE FROM public.sig_reference; DELETE FROM public.signature; DELETE FROM public.sig_class; DELETE FROM public.reference_system; ALTER SEQUENCE public.sig_class_sig_class_id_seq RESTART WITH 1; See my thread "Barnyard2 fatal error duplicate references, but there are no duplicates" from thu, 1 Nov 2012. /Elof On Tue, 7 Jul 2015, Avery Rozar wrote:
I get this error when I try to start barnyard, what is the proper solution for this? If I run the SQL query I only get one result so I'm not sure what the issue may be. ERROR database: Query [SELECT ref_id FROM reference WHERE ref_system_id = '10' AND ref_tag = '27676';] returned more than one result [SystemCacheSynchronize()], Call to ReferencePopulateDatabase() failed [CacheSynchronize()]:, SystemCacheSyncronize() call failed. SQL Query on the database: csdashboard=# SELECT ref_id FROM reference WHERE ref_system_id = '10' AND ref_tag = '27676'; ref_id -------- 26976 (1 row)
------------------------------------------------------------------------------ Don't Limit Your Business. Reach for the Cloud. GigeNET's Cloud Solutions provide you with the tools and support that you need to offload your IT needs and focus on growing your business. Configured For All Businesses. Start Your Cloud Today. https://www.gigenetcloud.com/ _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Barnyard2 DB error and it will not start Avery Rozar (Jul 07)
- <Possible follow-ups>
- Barnyard2 DB error and it will not start Avery Rozar (Jul 07)
- Re: Barnyard2 DB error and it will not start elof (Jul 10)