[rsyslog] more 5.1.3 errors (fwd) / invalid fromhost

david at lang.hm david at lang.hm
Mon Aug 24 23:06:47 CEST 2009

On Mon, 24 Aug 2009, david at lang.hm wrote:

> On Fri, 21 Aug 2009, Rainer Gerhards wrote:
>> David,
>> I think I have found the bug :) It was one of those that you actually
>> overlook while reviewing code, creating the test branches helped. I used an
>> "and" where an "or" war required in a predicate check, thus strings were
>> always re-used if the size of the former and the current string matched. 
>> That
>> would very well explain what you saw (the host IPs were of equal length). 
>> In
>> any case, it is a bug, and it is fixed in the master branch:
>> http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=cdb58f8d913dc47b01f61f5a
>> 72a83ce6aea26623
>> Just in case it should not address what you see, I have created two testing
>> branches for you: these are "david-test2a" and "david-test2b". They disable
>> different parts of the reuse logic (while crafting 2b I finally saw the
>> issue...).
> I compiled and installed master (commit b0d76b2c) and it looks like it solved 
> this problem
> I'm testing to see if it has the problem I reported with 4.2.1 where it dies 
> under load from malformed messages.

It finally died just like 4.2.1 did. It took a _lot_ longer (which may 
just be that the race condition to cause the crash is smaller, 5.x is 
_significantly_ more efficiant than 4.x is. processing ~1800 messages/sec, 
writing them locally and relaying them to another machine eats up <2% cpu 
according to top)

I restarted it in debug mode (this takes more cpu, almost 10% of a cpu)

David Lang

More information about the rsyslog mailing list