[Bro] Long lived MySQL session stops generating events

[Bruce Kao]

Hi All,


I am running Bro version 2.5.2, and encountering an issue where an established MySQL session after idling for some time (approximately 10 minutes), the MySQL analyzer events are no longer generated.


The MySQL session itself is still alive and still responding to queries, but the analyzer event mysql_command_request stop generating.  I've also check packet capture and seen no obvious oddities and the packets are the same as when it was working.  I am only issuing a 'Use DB' command for testing.


I suspect there is a timeout somewhere or a limit somewhere that I'm not aware of, as I am still fairly new to Bro itself.


Does anyone have any ideas on how I can continue to debug this issue?


Thanks in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20181012/4fc80c96/attachment.html