#219 Sql Error while page reload

[Martin Hochreiter]

Hi!

I am using Base 1.4.3.1 on top of a mysql database fed by 4 snort - barnyard sensors.
Sometimes while the page of BASE automatically reloads, I get the following messages:

/var/www/base/includes/base_cache.inc.php:776: ERROR:
1 alerts have NOT found their way into acid_event with sid = 5

/var/www/base/includes/base_cache.inc.php:521: ERROR: Alert "5 - 135" could NOT be found in acid_event.

/var/www/base/includes/base_cache.inc.php:521: ERROR: Alert "5 - 136" could NOT be found in acid_event.

/var/www/base/includes/base_cache.inc.php:521: ERROR: Alert "5 - 137" could NOT be found in acid_event.

/var/www/base/includes/base_cache.inc.php:521: ERROR: Alert "5 - 138" could NOT be found in acid_event.

/var/www/base/includes/base_cache.inc.php:521: ERROR: Alert "5 - 139" could NOT be found in acid_event.

What goes wrong here?

[Juergen Leising]

Hello Martin,

you said, SOMETIMES WHILE the web page was reloading, those errors occured. So eventually right these alerts do get inserted into acid_event, don't they?
These errors are no persistent errors, are they? If so, then it is "just" a race condition.

I'm going to have a look at it.

Bye, bye

Juergen

[Nobody/Anonymous]

Hello Juergen!

I root caused the whole issue in the meantime.
The error occurs when event categories are missing, e.g. ignored.
You have somewhere in the code an array that has something
like "spp_*", ... in it (don't ask me the exact position - i am at home
and the machine is in the office) and if you have an alert that does
not respond to that array then you get that warning.

lg