Unable to get mysql performance in packetbeat


(Akhilesh Anb) #1

Im not getting the mysql performance in packetbeat. I'm getting http requests in packetbeat. I have done the tracing by "packetbeat -e -dump trace.pcap"... but the output for that command is nothing. I didnt get anything. Please help me to get the mysql performance

Im using ubuntu and mysql with port 3306. Im using kibana4 as dashboard.
Http performance: i'm able to get

Mysql performance: I'm not getting anything

This is my conf file:


Unable to get mysql stats using packet beats
(Tudor Golubenco) #2

Thanks for the details. Just to confirm, you are using Paketbeat version 1.0.0~Beta1, right? You need to leave the packetbeat -e -dump trace.pcap running for a bit so that it captures some traffic. Is the trace.pcap file empty?


(Akhilesh Anb) #3

Yes i'm using Paketbeat version 1.0.0~Beta1.. I'm not getting anything if im running that command.


(Tudor Golubenco) #4

Ok, to confirm that traffic is flowing on port 3306, can you try doing the same trace with tcpdump? The syntax should be:

tcpdump -s0 -w trace.pcap "port 3306"

If that works, then please send us the pcap file.


(Akhilesh Anb) #5

i'm getting this output :

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

Can you tell me where will be the pcap file?


(Tudor Golubenco) #6

Ok, just keep it running for a minute or two, stop it with ^C and than see if it created trace.pcap.


(Akhilesh Anb) #7

this is the output if i do ^C :

2 packets received by filter
0 packets dropped by kernel


(Tudor Golubenco) #8

Hmm, only 2 packets. That seems a bit low. What about trace.pcap, was it created? If yes, please send it to us. (If you cannot upload it here, please email it to tudor@elastic.co).


(Akhilesh Anb) #9

Where will be that file trace.pcap .. when i stop that, i didn't see any file was created with that name.


(Tudor Golubenco) #10

Should have been in your current working directory. That's strange, tcpdump should have at least created an empty (24 bytes long actually) file.


(Tudor Golubenco) #11

If you cannot find it, lets try this test:

  • In one terminal tab, start tcpdump and and leave it running:

       tcpdump -i lo -s 0 -w trace.pcap "port 3306"
    
  • On another terminal tab, start the mysql prompt replacing root with a user you have for mysql:

      mysql -h 127.0.0.1 -u root
    
  • On the mysql prompt to a simple select like:

      select 1;
    
  • Stop tcpdump and check that the trace.pcap file was created.


Unable to get mysql stats using packet beats
(Akhilesh Anb) #13

After doing this also i sent you another trace.pacp file to your id.


(Tudor Golubenco) #14

Ok, first file was empty, second one contain the select 1 as expected.

Just for completeness you can do the same, but instead of tcpdump you can use packetbeat like this:

packetbeat -e -d "publish" -N

It should print a JSON object for that select.

What I suspect is going on is that your application connects to MySQL via the unix sockets rather than the network. The way to force it using the network is usually to tell it to connect to 127.0.0.1 rather than localhost. What programming lagnuage / stack are you having?


(Akhilesh Anb) #15

This is the output for that command:

publish.go:221: INFO Dry run mode. All output types except the file based one are disabled.
geolite.go:61: INFO Loaded GeoIP data from: /usr/share/GeoIP/GeoIP.dat
publish.go:267: INFO No shipper name configured, using hostname 'ip-10-150-147-210'
procs.go:88: INFO Process matching enabled


(Tudor Golubenco) #16

Hmm, did you do the select while packetbeat was running? The trace you sent definitely works on my computer.


(Akhilesh Anb) #17

In one terminal im running this command :
packetbeat -e -d "publish" -N
In one terminal i started mysql and done select query..
when i did this.. i got output in other terminal where im running the 1st command but i'm not getting anything on dashboard.
.


This is the output where im running the first command:


(Akhilesh Anb) #18

Im getting this as shown in above screenshot:
mysql.go:563: WARN Response from unknown transaction. Ignoring.

I'm not getting anything on dashboard.


(Akhilesh Anb) #19

I'm getting everything what im doing in mysql to elasticsearch. But im unable to get it in dashboard.


(Tudor Golubenco) #20

Ok, cool, so it works fine when using the mysql client. If you remove the -N, i.e. packetbeat -e -d "publish", it should also insert into Elasticsearch so you will see the transactions in Kibana.


(Akhilesh Anb) #21

Thanq very much for the support Tudor... Now everything is working fine and visualization is excellent.