# Monitoring local database access(not via ethernet) **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [October 22, 2015, 12:36am UTC](https://discuss.elastic.co/t/monitoring-local-database-access-not-via-ethernet/32733 "2015-10-22T00:36:07Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![MingchunZhao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mingchunzhao/32/5372_2.png) [@MingchunZhao](https://discuss.elastic.co/u/MingchunZhao)\ **Post date:** [October 22, 2015, 12:36am UTC](https://discuss.elastic.co/t/monitoring-local-database-access-not-via-ethernet/32733/1 "2015-10-22T00:36:07Z")
Would you have any plan for Packetbeat to deal with local access to a database? Sorry for the question that might be a bit off-topic. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 22, 2015, 2:32pm UTC](https://discuss.elastic.co/t/monitoring-local-database-access-not-via-ethernet/32733/2 "2015-10-22T14:32:59Z")
Can you explain 'local access to a database'? packetbeat has protocol analysers for mysql and postgresql. ---
**Author:** ![MingchunZhao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mingchunzhao/32/5372_2.png) [@MingchunZhao](https://discuss.elastic.co/u/MingchunZhao)\ **Post date:** [October 23, 2015, 5:26am UTC](https://discuss.elastic.co/t/monitoring-local-database-access-not-via-ethernet/32733/3 "2015-10-23T05:26:28Z")
What I meant was that connections via Unix Domain Socket(or via PIPE,MEMORY on Windows) to MySQL,PostgreSQL. The following is what I've tried: First, connect with telnet to server where MySQL or PostgreSQL is running. and then, ### For MySQL ####sniffing a tcp connection succeeded: shell\> mysql --protocol=tcp -u xxx -p ####sniffing a socket connection failed: shell\> mysql --protocol=socket -u xxx -p ### For PostgreSQL ####sniffing a tcp connection succeeded: shell\> psql -h localhost ####sniffing a socket connection failed: shell\> psql ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 26, 2015, 2:56pm UTC](https://discuss.elastic.co/t/monitoring-local-database-access-not-via-ethernet/32733/4 "2015-10-26T14:56:32Z")
You are right, unix sockets or pipes are not supported. What's the exact usecase? If you are worried by having you database open to public, restrict your database to bind the socket to localhost only. This way only localhost can access your database. Alternatively you can use socat to forward from unix socket to tcp port to get similar behavior for shell tool (or use alias in your shell). packetbeat is mainly supposed to work on network traffic. Trying to get it to work with unix sockets might be some major effort to implement. On linux ptrace (approach used by strace) might be possible, or maybe even leveraging systemtap (not sure). ---
**Author:** ![MingchunZhao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mingchunzhao/32/5372_2.png) [@MingchunZhao](https://discuss.elastic.co/u/MingchunZhao)\ **Post date:** [October 27, 2015, 4:35am UTC](https://discuss.elastic.co/t/monitoring-local-database-access-not-via-ethernet/32733/5 "2015-10-27T04:35:23Z")
Hi Steffen, It's so kind of you to answer this off-topic discussion. My usecase is as follows: Assuming I need to monitor privilege user access to database by Packetbeat in purpose of an audit, It is very important to sniff on certain protocols including socket,pipe to meet security requirement(e.g. SOX). So considering my usecase, the best thing is Packetbeat will be able to support unix socket or pipe, However, those workarounds as you mentioned is very helpful for me, Best Regards, Mingchun ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 27, 2015, 3:32pm UTC](https://discuss.elastic.co/t/monitoring-local-database-access-not-via-ethernet/32733/6 "2015-10-27T15:32:25Z")
Yeah, I'm not aware of any good sniffer for unix sockets. It might be possible by writing a kernel module (like SystemTap does) or use ptrace tricks. Using ptrace means basically writing a debugger attaching to all processes opening the unix socket (not recommended). For very very simple auditing maybe SystemTap can be useful (basically uses kernel module approach). See this example [sniffing unix sockets](https://sourceware.org/systemtap/wiki/WSunixSockets). Maybe you can find process name and uid of processes communicating. But for application layer analysis and indexing having an active proxy (e.g. socat) might be the better option. When using socat you can debug/test approach using tcpdump. If required you can still try to disable pipe (unix sockets) in general forcing users to use TCP only. ---
**Author:** ![MingchunZhao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mingchunzhao/32/5372_2.png) [@MingchunZhao](https://discuss.elastic.co/u/MingchunZhao)\ **Post date:** [October 28, 2015, 12:37am UTC](https://discuss.elastic.co/t/monitoring-local-database-access-not-via-ethernet/32733/7 "2015-10-28T00:37:07Z")
Thanks for your detailed information on sniffing unix sockect. I'll look into these approaches. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/monitoring-local-database-access-not-via-ethernet/32733/8 "2017-07-05T21:58:33Z")