[rsyslog] abort in 4.2.1

Rainer Gerhards rgerhards at hq.adiscon.com
Wed Aug 26 11:36:30 CEST 2009


> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of david at lang.hm
> Sent: Wednesday, August 26, 2009 11:32 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] abort in 4.2.1
> 
> On Wed, 26 Aug 2009, Rainer Gerhards wrote:
> 
> > David,
> >
> > quick question: you originally quoted the bug with 4.2.1. I just
> tried to
> > find out the differences to this module and saw that there no
> official 4.2.1
> > exists. Did you mean 4.3.1 or an interim snapshot? If you no longer
> know it,
> > don't try hard to find out. I can probably do well enough with the
> info I
> > have, but this extra bit may be useful to verify I am looking at the
> right
> > pieces.
> 
> I thought that it was 4.2.1, it was the v4-stable branch while you were
> on
> vacation. I first tried installing 5.x on the box, but it had the name
> problem, so I went to the 4.x branch instead. I can check on another
> machine in the morning, but since I didn't label it with the git commit
> I don't know how accurate anything I will find will be.
>

That's good enough - it is extremely probable I am looking at the right set
of changes (plus, I really need the changes just for the overall picutre, the
abort location itself - with the debug log - is sufficient).

FYI: I am right now analyzing the crash, but it looks I was a bit too
optimistic this morning. I don't yet see anything that can cause the
segfault. We probably need to go through some test iterations (I am trying to
repro in my lab with some samples I think that may be useful based on what I
saw).

I think it would be a good idea to focus these tests on v4 (same code as v5),
as it seems to be easier to reproduce with it. Is that OK with you?

 
> I haven't ever had rsyslog running in the location that's crashing, so
> there's no way of knowing how far back the bug has been there.

If you would like to give it a try, it could possibly be that 4.2.0 does not
have it. If it has, the location is somewhere different (what I still tend to
think, but...).

Rainer

> 
> David Lang
> 
> > Rainer
> >
> >> -----Original Message-----
> >> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> >> bounces at lists.adiscon.com] On Behalf Of david at lang.hm
> >> Sent: Tuesday, August 25, 2009 11:57 PM
> >> To: rsyslog-users
> >> Subject: Re: [rsyslog] abort in 4.2.1
> >>
> >> On Tue, 25 Aug 2009, Rainer Gerhards wrote:
> >>
> >>> First shot at it:
> >>>
> >>> 1. Make sure core dump is written (ulimit -c 999999999)
> >>> 2. Have it abort
> >>> 3. bdb /path/to/binary/tsyslogd
> >>> 4. Core name-of-corefile (usually /core.SOMENBR)
> >>> 5. Enter: bt (for backtrace)
> >>> 6. Enter: info thread (displays threads)
> >>> 7. For each thread:
> >>> 7a. Thread number
> >>> 7b. Bt
> >>> 8. You are done (ctl-d)
> >>
> >> Core was generated by `rsyslogd -c5 -x'.
> >> Program terminated with signal 11, Segmentation fault.
> >> [New process 11534]
> >> [New process 11538]
> >> [New process 11535]
> >> [New process 11537]
> >> [New process 11533]
> >> [New process 11536]
> >> #0  sanitizeMessage (pMsg=0x7f312c001530) at parser.c:222
> >> 222                     if(pszMsg[iSrc] == '\0') { /* guard against
> \0
> >> characters... */
> >> (gdb) bt
> >> #0  sanitizeMessage (pMsg=0x7f312c001530) at parser.c:222
> >> #1  0x00000000004161f1 in parseMsg (pMsg=0x7f312c001530) at
> >> parser.c:260
> >> #2  0x000000000040b6fc in msgConsumer (notNeeded=<value optimized
> out>,
> >> pBatch=0xa2af98) at syslogd.c:942
> >> #3  0x000000000042df9e in ConsumerReg (pThis=0xa30b00,
> pWti=0xa2af70)
> >> at queue.c:1818
> >> #4  0x0000000000428220 in wtiWorker (pThis=0xa2af70) at wti.c:276
> >> #5  0x00000000004279ac in wtpWorker (arg=0xa2af70) at wtp.c:349
> >> #6  0x00007f313e4ebfc7 in start_thread () from /lib/libpthread.so.0
> >> #7  0x00007f313de545ad in clone () from /lib/libc.so.6
> >> #8  0x0000000000000000 in ?? ()
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com



More information about the rsyslog mailing list