Packetbeat capture only use query not others like select, insert, update

Elastic Stack Beats
1

I have configured packetbeat to monitor mysql and redirect that ELK

The issue that i have is that it only detect use query and no other query like selects or inserts updates i don''t understand why.

The port configured is correct and ssl is disable on mysql.

Can you help ?

Sometime in the logs i see stuff like ''mysql":{"unmatched_responses":2141}'', not sure if its related or not

Thanks

2

Hi Yecine,

Here are a few pointers, let me know if you've already checked all of those:

  • Make sure you're not connecting locally via the socket :slight_smile: You'll want to ensure you're running your client or your library by connecting via either 127.0.0.1 or your remote address.
  • When connecting over the network, you need to ensure Packetbeat is monitoring the correct network interface.
    • On Linux you can monitor them all with packetbeat.interfaces.device: all
    • On other OSes you will have to specify one network interface explicitly. If you're connecting locally, you'd have to configure something like this: packetbeat.interfaces.device: lo0. Check your interface IDs with ifconfig on Posix systems, or ipconfig on Windows.

If those don't help, can you give a few more details about your situation?

  • Are you installing Packetbeat on the MySQL server directly, or trying to monitor traffic remotely?
  • What version of MySQL and Packetbeat are you using?

The "unmatched_responses" error would be expected when Packetbeat sees responses to queries it's unaware of (e.g. MySQL queries sent just before starting Packetbeat). Unless you're trying this on a high traffic server, I wouldn't expect it to reach 2000+ while you're starting up Packetbeat. We may need to dig deeper there.

3

Hello,

Web and database server are separated.

We have tried to put packet beat on both and i have the same result

We are connecting to the database throught it's ip so it's should be ok on this side.

We are on linuw so we have tried using device any and that didn't change anything

Here are the version of mysql and packetbeat :
mysql Ver 14.14 Distrib 5.5.60
packetbeat 6.4.1

Thanks for you help

4

@webmat do you have an idea what is happening ?

Thanks

5

Could you do/answer the following please:

  • Which port is MySQL available on?
  • Run packetbeat devices and post the results here
  • Paste your packetbeat.yml config here. Please make sure to remove any sensitive information first
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.