[rsyslog-notify] Forum Thread: Re: rsyslog crashes with omrelp - (Mode 'reply')
noreply at adiscon.com
noreply at adiscon.com
Thu Sep 3 13:12:22 CEST 2015
User: nottoosmart
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25886#p25886
Message:
----------
Here is one example of failure (I have edited parts of the actual syslog
message for privacy):
8316.227267632:imrelp.c : relp session read 415 octets, buf '10
syslog 400 <86>2015-09-03T04:02:57.157111-07:00 <server name would go here>
audispd: type=USER_ROLE_CHANGE msg=audit(1441278177.155:409055): user
pid=2430925 uid=0 auid=0 ses=724350 subj=system_u:base_r:base_t msg='pam:
default-context=user_u:base_r:base_t selected-context=user_u:base_r:base_t
exe="/usr/sbin/sshd" hostname=<IPV6 address would go here> addr=<IPV6
address would go here> terminal=ssh res=success'
'
8316.227278549:imrelp.c : relp engine is dispatching frame with
command 'syslog'
8316.227281695:imrelp.c : in 'syslog' command handler
8316.227289495:imrelp.c : main Q: qqueueAdd: entry added, size now
log 8, phys 9 entries
8316.227292978:imrelp.c : main Q: EnqueueMsg advised worker start
rsyslogd: ath.c:193: _gcry_ath_mutex_lock: Assertion `*lock ==
((ath_mutex_t) 0)' failed.
Something else strange to note is that everytime I run rsyslog with
valgrind (sudo valgrind --log-fd=1 rsyslogd -nd), I can never get this
crash to happen. 100% of the time, without valgrind, it will crash.
More information about the rsyslog-notify
mailing list