You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@metron.apache.org by "Neha Sinha (JIRA)" <ji...@apache.org> on 2016/06/17 11:06:05 UTC
[jira] [Commented] (METRON-100) GeoIP errors out silently in
vagrant
[ https://issues.apache.org/jira/browse/METRON-100?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15335868#comment-15335868 ]
Neha Sinha commented on METRON-100:
-----------------------------------
Hi,
I have tested the fix on latest metron cluster(built with commit id commit 739e2eb523dd6b4daeeccd3bab5a4a614ace8328) and it works as expected.
I used the following bro testdata for my testing :-
{"http":{"ts":1466156706.515081,"uid":"CNAy7y2Wdk89qPcGnh","id.orig_h":"1.1.1.1","id.orig_p":49206,"id.resp_h":"2.2.2.2","id.resp_p":80,"trans_depth":4,"method":"GET","host":"7oqnsnzwwnm6zb7y.gigapaysun.com","uri":"/img/style.css","referrer":"http://7oqnsnzwwnm6zb7y.gigapaysun.com/11iQmfg","user_agent":"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)","request_body_len":0,"response_body_len":0,"status_code":304,"status_msg":"Not Modified","tags":[]}}
Expected ip_src_addr country code = AU
Expected ip_dst_addr country code = FR
Actual ip_src_addr country code = AU
Actual ip_dst_addr country code = FR
Note:- I was able to reproduce the issue on metron setup built with code prior to the fix(commit f374daa05abd68a5a962be3da5a429b496778e8c).Geoip enrichment did not happen and also error message was seen in the logs.
Regards,
Neha
> GeoIP errors out silently in vagrant
> ------------------------------------
>
> Key: METRON-100
> URL: https://issues.apache.org/jira/browse/METRON-100
> Project: Metron
> Issue Type: Bug
> Reporter: Casey Stella
>
> GeoIP Enrichment errors out silently in vagrant. It's unclear whether it's just some data that is problematic or everything, but I see this in the logs:
> com.mysql.jdbc.MysqlDataTruncation: Data truncation: Data too long for column 'ip' at row 1
> at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:4224) ~[stormjar.jar:?]
> at com.mysql.jdbc.MysqlIO.nextRowFast(MysqlIO.java:2188) ~[stormjar.jar:?]
> at com.mysql.jdbc.MysqlIO.nextRow(MysqlIO.java:2044) ~[stormjar.jar:?]
> at com.mysql.jdbc.MysqlIO.readSingleRowSet(MysqlIO.java:3538) ~[stormjar.jar:?]
> at com.mysql.jdbc.MysqlIO.getResultSet(MysqlIO.java:489) ~[stormjar.jar:?]
> at com.mysql.jdbc.MysqlIO.readResultsForQueryOrUpdate(MysqlIO.java:3240) ~[stormjar.jar:?]
> at com.mysql.jdbc.MysqlIO.readAllResults(MysqlIO.java:2411) ~[stormjar.jar:?]
> at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2834) ~[stormjar.jar:?]
> at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2834) ~[stormjar.jar:?]
> at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2783) ~[stormjar.jar:?]
> at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1569) ~[stormjar.jar:?]
> at org.apache.metron.enrichment.adapters.geo.GeoAdapter.enrich(GeoAdapter.java:50) [stormjar.jar:?]
> at org.apache.metron.enrichment.adapters.geo.GeoAdapter.enrich(GeoAdapter.java:28) [stormjar.jar:?]
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)