Dan Achin
06/08/2021, 6:57 PMVersion: '5.7.12' socket: '/tmp/mysql.sock' port: 3306 MySQL Community Server (GPL)
21:20:21 UTC - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
Attempting to collect some information that could help diagnose the problem.
As this is a crash and something is definitely wrong, the information
collection process might fail.
key_buffer_size=16777216
read_buffer_size=262144
max_used_connections=3
max_threads=1000
thread_count=4
connection_count=3
connection_count=3
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 544680 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (2b4de31a4a90): INSERT IGNORE INTO scheduled_query_stats ( scheduled_query_id, host_id, average_memory, denylisted, executions, schedule_interval, last_executed, output_size, system_time, user_time, wall_time ) VALUES ((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?),((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?),((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?),((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?),((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?)
Connection ID (thread ID): 3
Status: NOT_KILLED
The manual page at <http://dev.mysql.com/doc/mysql/en/crashing.html> contains
information that should help you find out what is causing the crash.
Writing a core file
buddwm
06/08/2021, 10:37 PM2021-06-08T22:34:09.235157+00:00 <redacted> fleet[5699]: {"component":"http","err":"authentication error: finding host","level":"info","path":"/api/v1/osquery/log","ts":"2021-06-08T22:34:09.234995728Z"}
2021-06-08T22:34:09.271781+00:00 <redacted> fleet[5699]: {"component":"service","err":"authentication error: finding host","ip_addr":"127.0.0.1:35368","level":"info","method":"AuthenticateHost","took":"1.9962ms","ts":"2021-06-08T22:34:09.271652715Z","x_for_ip_addr":"<redacted>"}
....
2021-06-08T22:34:12.483990+00:00 <redacted> fleet[5699]: {"component":"service","err":"failed to save labels: insert label query executions: Error 1290: The MySQL server is running with the --read-only option so it cannot execute this statement","ip_addr":"127.0.0.1:35864","level":"info","method":"SubmitDistributedQueryResults","took":"35.482963ms","ts":"2021-06-08T22:34:12.483832798Z","x_for_ip_addr":"<redacted>"}
...
2021-06-08T22:34:18.760844+00:00 <redacted> fleet[5699]: [mysql] 2021/06/08 22:34:18 packets.go:36: read tcp <redacted>:44738->10.242.0.34:3306: read: connection reset by peer
2021-06-08T22:34:18.760936+00:00 <redacted> fleet[5699]: [mysql] 2021/06/08 22:34:18 packets.go:36: read tcp <redacted>:45138->10.242.0.34:3306: read: connection reset by peer
Dan Achin
06/08/2021, 10:43 PMbuddwm
06/09/2021, 6:46 PMfleet[23769]: {"component":"http","err":"authentication error: finding host","level":"info","path":"/api/v1/osquery/distributed/read","ts":"2021-06-07T19:02:36.696209002Z"}
We see a lot of related messages after upgrading and wondering if this is related to the DB fall over we seezwass
06/09/2021, 8:05 PMbuddwm
06/09/2021, 8:18 PMQuery (2b4de31a4a90): INSERT IGNORE INTO scheduled_query_stats ( scheduled_query_id, host_id, average_memory, denylisted, executions, schedule_interval, last_executed, output_size, system_time, user_time, wall_time ) VALUES ((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?),((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?),((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?),((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?),((SELECT sq.id FROM scheduled_queries sq JOIN packs p ON (sq.pack_id = p.id) WHERE p.name = ? AND sq.name = ?),?,?,?,?,?,?,?,?,?,?)
Connection ID (thread ID): 3
zwass
06/09/2021, 9:50 PMbuddwm
06/09/2021, 9:56 PMzwass
06/09/2021, 10:06 PMbuddwm
06/10/2021, 8:11 PM{
"component": "service",
"err": "failed to ingest result: loading orphaned campaign: selecting distributed query campaign: sql: no rows in result set",
"ip_addr": "127.0.0.1:40492",
"level": "info",
"method": "SubmitDistributedQueryResults",
"took": "4.25624ms",
"ts": "2021-06-10T20:17:33.405509079Z",
"x_for_ip_addr": "<redacted>"
}
Dan Achin
06/11/2021, 5:10 PMlist hosts: Error 1054: Unknown column 'additional' in 'field list'
I think we'll just stick at 3.12, but wondering if it's worth opening a git issue on that so that the Fleet team can look at it. Not sure if it's somehow our issue or Fleet's.zwass
06/11/2021, 7:55 PMDan Achin
06/11/2021, 10:27 PM