Author Topic: In Security onion and part of squert not show result and information  (Read 7451 times)

golfreeze

  • Administrator
  • Hero Member
  • *****
  • Posts: 2145
    • View Profile
    • นั่งสมาธิ สติปัฏฐานสี่ พาเที่ยววัด แนะนำวัด แจกcd ธรรมะฟรี
    • Email
In Security onion and part of squert not show result and information
« on: พฤศจิกายน 21, 2018, 02:20:41 PM »
In Security onion and part of squert not show result and information
then trace on error.log in mysql and found below

##### In master node
#tail -f /var/log/mysql/error.log
2018-11-21T05:04:01.843632Z 114 [ERROR] /usr/sbin/mysqld: Can't open file: './sodb/tcphdr_so@002dsensor01@002dens192@002d9_20181119.frm' (errno: 24 - Too many open files)

###How to fixed error 24
https://github.com/Security-Onion-Solutions/security-onion/wiki/FAQ#i-get-periodic-mysql-crashes-andor-error-code-24-out-of-resources-when-searching-in-sguil--how-do-i-fix-that
https://bugs.launchpad.net/ubuntu/+source/mysql-5.6/+bug/1434758

# mkdir -p /lib/systemd/system/mysql.service.d/
# vi /lib/systemd/system/mysql.service.d/limit_nofile.conf

[Service]
LimitNOFILE=60000
# systemctl daemon-reload
# systemctl restart mysql

#mysql -p
mysql> SHOW VARIABLES LIKE '%open%';
+----------------------------+----------+
| Variable_name              | Value    |
+----------------------------+----------+
| have_openssl               | DISABLED |
| innodb_open_files          | 2000     |
| open_files_limit           | 60000    |
| table_open_cache           | 2000     |
| table_open_cache_instances | 16       |
+----------------------------+----------+
5 rows in set (0.00 sec)

Done!