Unable to get mysql performance in packetbeat

Elastic Stack Beats
1

Im not getting the mysql performance in packetbeat. I'm getting http requests in packetbeat. I have done the tracing by "packetbeat -e -dump trace.pcap"... but the output for that command is nothing. I didnt get anything. Please help me to get the mysql performance

Im using ubuntu and mysql with port 3306. Im using kibana4 as dashboard.
Http performance: i'm able to get

Mysql performance: I'm not getting anything

This is my conf file:

2

Thanks for the details. Just to confirm, you are using Paketbeat version 1.0.0~Beta1, right? You need to leave the packetbeat -e -dump trace.pcap running for a bit so that it captures some traffic. Is the trace.pcap file empty?

1 Like
3

Yes i'm using Paketbeat version 1.0.0~Beta1.. I'm not getting anything if im running that command.

4

Ok, to confirm that traffic is flowing on port 3306, can you try doing the same trace with tcpdump? The syntax should be:

tcpdump -s0 -w trace.pcap "port 3306"

If that works, then please send us the pcap file.

5

i'm getting this output :

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

Can you tell me where will be the pcap file?

6

Ok, just keep it running for a minute or two, stop it with ^C and than see if it created trace.pcap.

7

this is the output if i do ^C :

2 packets received by filter
0 packets dropped by kernel

8

Hmm, only 2 packets. That seems a bit low. What about trace.pcap, was it created? If yes, please send it to us. (If you cannot upload it here, please email it to tudor@elastic.co).

9

Where will be that file trace.pcap .. when i stop that, i didn't see any file was created with that name.

10

Should have been in your current working directory. That's strange, tcpdump should have at least created an empty (24 bytes long actually) file.

11

If you cannot find it, lets try this test:

  • In one terminal tab, start tcpdump and and leave it running:

       tcpdump -i lo -s 0 -w trace.pcap "port 3306"

  • On another terminal tab, start the mysql prompt replacing root with a user you have for mysql:

      mysql -h 127.0.0.1 -u root

  • On the mysql prompt to a simple select like:

      select 1;

  • Stop tcpdump and check that the trace.pcap file was created.

13

After doing this also i sent you another trace.pacp file to your id.

14

Ok, first file was empty, second one contain the select 1 as expected.

Just for completeness you can do the same, but instead of tcpdump you can use packetbeat like this:

packetbeat -e -d "publish" -N

It should print a JSON object for that select.

What I suspect is going on is that your application connects to MySQL via the unix sockets rather than the network. The way to force it using the network is usually to tell it to connect to 127.0.0.1 rather than localhost. What programming lagnuage / stack are you having?

15

This is the output for that command:

publish.go:221: INFO Dry run mode. All output types except the file based one are disabled.
geolite.go:61: INFO Loaded GeoIP data from: /usr/share/GeoIP/GeoIP.dat
publish.go:267: INFO No shipper name configured, using hostname 'ip-10-150-147-210'
procs.go:88: INFO Process matching enabled

16

Hmm, did you do the select while packetbeat was running? The trace you sent definitely works on my computer.

1 Like
17

In one terminal im running this command :
packetbeat -e -d "publish" -N
In one terminal i started mysql and done select query..
when i did this.. i got output in other terminal where im running the 1st command but i'm not getting anything on dashboard.
.

This is the output where im running the first command:

18

Im getting this as shown in above screenshot:
mysql.go:563: WARN Response from unknown transaction. Ignoring.

I'm not getting anything on dashboard.

19

I'm getting everything what im doing in mysql to elasticsearch. But im unable to get it in dashboard.

20

Ok, cool, so it works fine when using the mysql client. If you remove the -N, i.e. packetbeat -e -d "publish", it should also insert into Elasticsearch so you will see the transactions in Kibana.

1 Like
21

Thanq very much for the support Tudor... Now everything is working fine and visualization is excellent.

1 Like