Packetbeat & MySQL

[Kevin_Csuka]

Hi,

I'm running an Ubuntu 14.04 machine in Vagrant / Virtualbox, i spinned up a scotchbox, acting as a LAMP server.
Packetbeat 1.2.3 is sending data directly to Elasticsearch.
Elasticsearch is successfully receiving data from the server. So connection-wise everything is good. The bind-address of MySQL is set to 127.0.0.1

Data is inserted into a MySQL database named 'test1' via a php script. But this traffic is not shown in Kibana.
How can I view the impact of the performance in Kibana of that data being inserted?

[steffens (Steffen Siering)]

1. with virtual machines always check time being in sync.
2. have you tried plain mysql command line tool (make sure you connect via tcp, not unix socket) and do a SELECT 1; ?
3. is your script using prepared-statements? These are currently not supported by the protocol analyzer.

[Kevin_Csuka]

@steffens

1. with virtual machines always check time being in sync.

Check, time is indeed correct.

@steffens

2.have you tried plain mysql command line tool (make sure you connect via tcp, not unix socket) and do a SELECT 1; ?

Works.

mysql -h 127.0.0.1 -u root -p 

See this image: Imgur: The magic of the Internet

@steffens

3.Is your script using prepared-statements? These are currently not supported by the protocol analyzer

It's a very, very simple php code that POST"s three variables into the Database. For convience:

[code]$first_name = mysqli_real_escape_string($link, $_POST['firstname']);
$last_name = mysqli_real_escape_string($link, $_POST['lastname']);
$email_address = mysqli_real_escape_string($link, $_POST['email']);

$sql = "INSERT INTO persons (first_name, last_name, email_address) VALUES ('$first_name', '$last_name', '$email_address')";
echo "Records added successfully.";
} [/code]

So three variables are posted into the database. Should packetbeat send the metrics of the performance to Elasticsearch?

[steffens (Steffen Siering)]

Is php script connecting to database via unix socket?

[Kevin_Csuka]

I'm guessing it is...

mysqli_connect("127.0.0.1", "root", "steffens", "scotchbox");
 

[steffens (Steffen Siering)]

have you checked with netstat? Have you tried to capture a raw trace using tcpdump and check in wireshark traffic is send unencrypted on interface being monitored?

[Kevin_Csuka]

@steffens

ireshark traffic is send unencrypted on interface being monit

While inserting data into the database I performed

 packetbeat -e -dump trace.pcap 

I have no idea why, but the data is now shown in Kibana...
Thanks for the help!