MySQL prepared statement error during distributed/write.

[rfairburn]

Fleet version: v4.54.1

Web browser and operating system: N/A

---

💥  Actual behavior

{"component":"http","err":"error in query ingestion","ingestion-err":"ingesting query users: update host users: insert users: Error 1390 (HY000): Prepared statement contains too many placeholders","ip_addr":"18.210.186.34","level":"error","method":"POST","took":"773.90701ms","ts":"2024-08-13T22:06:08.67570001Z","uri":"/api/v1/osquery/distributed/write","x_for_ip_addr":"REDACTED"}

🧑‍💻  Steps to reproduce

1. Happens during distrubuted write.
2. Unsure the rest of the conditions to make this happen.

🕯️ More info (optional)

[zayhanlon]

@sharon-fdm labeling this bug as a p2 because it's impacting workflows for this customer (there is another associated bug #21296 that is also critical but i didn't label it because it looks like victor already merged a fix?) - would be great if we could squeeze these into 4.56

[sharon-fdm]

@zayhanlon, understood. Will estimate today. @noahtalerman, @lukeheath, I will try to prioritize this over bugs that are not P2 currently in our sprint.

[getvictor]

@zayhanlon This error suggests they're trying to insert a large number of host users into the DB, which doesn't seem right.

Is it possible they're actually hitting this issue: https://github.com/fleetdm/fleet/issues/18343

Can they try the query in the above issue and see if they're getting the right number of users?

[zayhanlon]

@ksatter @ddribeiro or @rfairburn can yall take a look at this?

[rfairburn]

@zayhanlon @getvictor it looks like the other ticket https://github.com/fleetdm/fleet/issues/18343 has the same customer tag. That indicates this is the same customer that reported that issue. When osquery 5.13.0 hits stable, this will go away.

[getvictor]

Workaround is to disable users and software_linux detailed queries.

[getvictor]

@rfairburn Now that 5.13.1 is stable, please confirm this issue is gone. If so, please close the ticket.

[getvictor]

@rfairburn Now that 5.13.1 is stable, please confirm this issue is gone. If so, please close the ticket.

[getvictor]

@rfairburn I'm closing this issue. Reopen if needed.

[fleet-release]

MySQL error fades, Ingestion runs smoothly now, Fleet's strength renewed, shines.