Bug#614061: rsyslog-mysql: You have an error in your SQL syntax; check the manual ...
Just for your information: I have begun to work on this issue and suspect it is an regression from the imuxsock changes. However, I have unfortunately not yet been able to reproduce it (but I could not yet try on Debian 6, will do that shortly). However, I created a new instrumented v5-beta-mysql-test gt branch and Michael is helping me try it out. Rainer -Original Message- From: Michael Biebl [mailto:bi...@debian.org] Sent: Monday, February 21, 2011 2:04 PM To: Rainer Gerhards; 614...@bugs.debian.org Cc: cont...@bugs.debian.org; Florian Ernst Subject: Re: Bug#614061: rsyslog-mysql: You have an error in your SQL syntax; check the manual ... tags 6144061 confirmed thanks Hi Rainer, Here's another v5 specific problem. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614061 Am 20.02.2011 09:06, schrieb Florian Ernst: On Sat, Feb 19, 2011 at 10:46:27PM +0100, Michael Biebl wrote: Am 19.02.2011 13:14, schrieb Florian Ernst: since updating to 5.7.3-1 rsyslog-mysql apparently fails to correctly parse / escape some strings. Could you please post such example strings? The type of string that led me to noticing this bevavior was included in my original report: the spamd line is the triggering line, the following line is the rsyslog db error message. So far this error only occured on my system with these spamd lines. Running rsyslog in debug mode might help to track this issue down, too: Run rsyslogd -c5 -dn for this and attach the output to the bug report. Attached, but I replaced my DB password with ReplacedPassword. A debug log is at http://bugs.debian.org/cgi- bin/bugreport.cgi?msg=15;filename=rsyslog.log;att=1;bug=614061 I can reproduce the problem here, so if you need more information/testing, just let me know. -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
Bug#614061: rsyslog-mysql: You have an error in your SQL syntax; check the manual ...
Thanks to Michael Biebl, I was able to nail down the problem. Spamd seems to write NUL-Bytes (0x00, '\0') into the system log. The new imuxsock has a regression in that it no longer does the escaping (including check for NUL-Bytes) that previously happened. I'll now re-enable the escaping code. It may take a little while because I must carefully evaluate how much I would like to change (a totally clean solution may have a lot of potential for new regressions, so I may move this effort to a new devel version instead). As a side-note, one may think if it is valid that spamd writes these NUL-Bytes. While this is obviously a problem in rsyslogd in the first place, I wonder if it were wiser not to write them. Rainer -Original Message- From: Rainer Gerhards [mailto:rgerha...@hq.adiscon.com] Sent: Tuesday, February 22, 2011 9:42 AM To: Michael Biebl; 614...@bugs.debian.org Cc: cont...@bugs.debian.org; Florian Ernst Subject: Bug#614061: rsyslog-mysql: You have an error in your SQL syntax; check the manual ... Just for your information: I have begun to work on this issue and suspect it is an regression from the imuxsock changes. However, I have unfortunately not yet been able to reproduce it (but I could not yet try on Debian 6, will do that shortly). However, I created a new instrumented v5-beta-mysql-test gt branch and Michael is helping me try it out. Rainer -Original Message- From: Michael Biebl [mailto:bi...@debian.org] Sent: Monday, February 21, 2011 2:04 PM To: Rainer Gerhards; 614...@bugs.debian.org Cc: cont...@bugs.debian.org; Florian Ernst Subject: Re: Bug#614061: rsyslog-mysql: You have an error in your SQL syntax; check the manual ... tags 6144061 confirmed thanks Hi Rainer, Here's another v5 specific problem. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614061 Am 20.02.2011 09:06, schrieb Florian Ernst: On Sat, Feb 19, 2011 at 10:46:27PM +0100, Michael Biebl wrote: Am 19.02.2011 13:14, schrieb Florian Ernst: since updating to 5.7.3-1 rsyslog-mysql apparently fails to correctly parse / escape some strings. Could you please post such example strings? The type of string that led me to noticing this bevavior was included in my original report: the spamd line is the triggering line, the following line is the rsyslog db error message. So far this error only occured on my system with these spamd lines. Running rsyslog in debug mode might help to track this issue down, too: Run rsyslogd -c5 -dn for this and attach the output to the bug report. Attached, but I replaced my DB password with ReplacedPassword. A debug log is at http://bugs.debian.org/cgi- bin/bugreport.cgi?msg=15;filename=rsyslog.log;att=1;bug=614061 I can reproduce the problem here, so if you need more information/testing, just let me know. -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
Bug#614061: rsyslog-mysql: You have an error in your SQL syntax; check the manual ...
tags 6144061 confirmed thanks Hi Rainer, Here's another v5 specific problem. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614061 Am 20.02.2011 09:06, schrieb Florian Ernst: On Sat, Feb 19, 2011 at 10:46:27PM +0100, Michael Biebl wrote: Am 19.02.2011 13:14, schrieb Florian Ernst: since updating to 5.7.3-1 rsyslog-mysql apparently fails to correctly parse / escape some strings. Could you please post such example strings? The type of string that led me to noticing this bevavior was included in my original report: the spamd line is the triggering line, the following line is the rsyslog db error message. So far this error only occured on my system with these spamd lines. Running rsyslog in debug mode might help to track this issue down, too: Run rsyslogd -c5 -dn for this and attach the output to the bug report. Attached, but I replaced my DB password with ReplacedPassword. A debug log is at http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=15;filename=rsyslog.log;att=1;bug=614061 I can reproduce the problem here, so if you need more information/testing, just let me know. -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? signature.asc Description: OpenPGP digital signature
Bug#614061: rsyslog-mysql: You have an error in your SQL syntax; check the manual ...
Following up to myself ... On Sun, Feb 20, 2011 at 09:06:04AM +0100, Florian Ernst wrote: On Sat, Feb 19, 2011 at 10:46:27PM +0100, Michael Biebl wrote: Am 19.02.2011 13:14, schrieb Florian Ernst: since updating to 5.7.3-1 rsyslog-mysql apparently fails to correctly parse / escape some strings. Could you please post such example strings? The type of string that led me to noticing this bevavior was included in my original report: the spamd line is the triggering line, the following line is the rsyslog db error message. So far this error only occured on my system with these spamd lines. It turns out I was wrong with this assertion: zgrep -h -o 'work rsyslogd: db error.*' /var/log/syslog* | sed -e 's/at port \([0-9]\+\)/at port \$PORTNUM/' | sort | uniq -c | sort -n 1 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' no servers found in /var/run/dnsmasq/resolv.conf, will retry' at line 1 1 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' read /etc/hosts - 9 addresses' at line 1 1 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: clean message (-10.4/5.0) for fernst:1000 in 14.7 seconds, 9191 bytes.' at line 1 1 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: clean message (-8.1/5.0) for fernst:1000 in 14.4 seconds, 5841 bytes.' at line 1 1 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: clean message (-9.3/5.0) for fernst:1000 in 14.4 seconds, 6627 bytes.' at line 1 1 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: setuid to fernst succeeded' at line 1 342 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: connection from localhost [127.0.0.1] at port $PORTNUM' at line 1 Here the complete syslog entries for those non-spamd: connection from localhost lines: Feb 19 10:38:05 work spamd[27687]: spamd: setuid to fernst succeeded Feb 19 10:38:05 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: setuid to fernst succeeded' at line 1 Feb 19 19:13:34 work spamd[24151]: spamd: clean message (-9.3/5.0) for fernst:1000 in 14.4 seconds, 6627 bytes. Feb 19 19:13:34 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: clean message (-9.3/5.0) for fernst:1000 in 14.4 seconds, 6627 bytes.' at line 1 Feb 19 21:06:58 work spamd[27113]: spamd: clean message (-10.4/5.0) for fernst:1000 in 14.7 seconds, 9191 bytes. Feb 19 21:06:58 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: clean message (-10.4/5.0) for fernst:1000 in 14.7 seconds, 9191 bytes.' at line 1 Feb 19 21:40:01 work spamd[27113]: spamd: clean message (-8.1/5.0) for fernst:1000 in 14.4 seconds, 5841 bytes. Feb 19 21:40:01 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: clean message (-8.1/5.0) for fernst:1000 in 14.4 seconds, 5841 bytes.' at line 1 Feb 20 00:00:10 work dnsmasq[2563]: read /etc/hosts - 9 addressesFeb 20 00:00:10 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' read /etc/hosts - 9 addresses' at line 1 (yes, this is quoted as-is, i.e. without a newline between the two entries) Feb 20 05:00:04 work dnsmasq[2563]: no servers found in /var/run/dnsmasq/resolv.conf, will retryFeb 20 05:00:04 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' no servers found in /var/run/dnsmasq/resolv.conf, will retry' at line 1 (yes, this is quoted as-is, i.e. without a newline between the two entries) On further note, I now see empty lines in my syslog directly before or
Bug#614061: rsyslog-mysql: You have an error in your SQL syntax; check the manual ...
Package: rsyslog-mysql Version: 5.7.3-1 Severity: normal Hello, since updating to 5.7.3-1 rsyslog-mysql apparently fails to correctly parse / escape some strings. Here on my system, I see in my syslog lots of occurences of | Feb 19 13:06:09 work spamd[24151]: spamd: connection from localhost [127.0.0.1] at port 36530 | Feb 19 13:06:09 work rsyslogd: db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' spamd: connection from localhost [127.0.0.1] at port 36530' at line 1 Consequently, the spamd messages don't end up in the database. This was previously working fine with rsyslog-mysql 4.6.4-2. Cheers, Flo -- System Information: Debian Release: wheezy/sid APT prefers wheezy APT policy: (990, 'testing'), (50, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 2.6.32-5-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages rsyslog-mysql depends on: ii dbconfig-common 1.8.46 common framework for packaging dat ii debconf [debconf-2.0] 1.5.38 Debian configuration management sy ii libc6 2.11.2-11Embedded GNU C Library: Shared lib ii libmysqlclient165.1.49-3 MySQL database client library ii rsyslog 5.7.3-1 enhanced multi-threaded syslogd ii ucf 3.0025+nmu1 Update Configuration File: preserv ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime Versions of packages rsyslog-mysql recommends: ii mysql-client 5.1.49-3 MySQL database client (metapackage ii mysql-client-5.1 [mysql-clien 5.1.49-3 MySQL database client binaries Versions of packages rsyslog-mysql suggests: ii mysql-server 5.1.49-3 MySQL database server (metapackage ii mysql-server-5.1 [mysql-serve 5.1.49-3 MySQL database server binaries and -- debconf information: rsyslog-mysql/remote/port: rsyslog-mysql/database-type: mysql rsyslog-mysql/install-error: abort rsyslog-mysql/remote/newhost: * rsyslog-mysql/dbconfig-install: true rsyslog-mysql/upgrade-backup: true rsyslog-mysql/dbconfig-remove: rsyslog-mysql/mysql/admin-user: root rsyslog-mysql/mysql/method: unix socket rsyslog-mysql/purge: false rsyslog-mysql/db/app-user: rsyslog rsyslog-mysql/upgrade-error: abort rsyslog-mysql/internal/skip-preseed: false rsyslog-mysql/remote/host: rsyslog-mysql/internal/reconfiguring: false rsyslog-mysql/missing-db-package-error: abort rsyslog-mysql/db/dbname: Syslog rsyslog-mysql/dbconfig-reinstall: false rsyslog-mysql/passwords-do-not-match: rsyslog-mysql/remove-error: abort rsyslog-mysql/dbconfig-upgrade: true signature.asc Description: Digital signature
Bug#614061: rsyslog-mysql: You have an error in your SQL syntax; check the manual ...
Am 19.02.2011 13:14, schrieb Florian Ernst: Package: rsyslog-mysql Version: 5.7.3-1 Severity: normal Hello, since updating to 5.7.3-1 rsyslog-mysql apparently fails to correctly parse / escape some strings. Could you please post such example strings? Running rsyslog in debug mode might help to track this issue down, too: Run rsyslogd -c5 -dn for this and attach the output to the bug report. Thanks, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? signature.asc Description: OpenPGP digital signature
