[rsyslog-notify] Forum Thread: Re: rsyslog crashes with omrelp - (Mode 'reply')

noreply at adiscon.com noreply at adiscon.com
Thu Sep 3 13:12:22 CEST 2015


User: nottoosmart 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25886#p25886

Message: 
----------
Here is one example of failure (I have edited parts of the actual syslog
message for privacy):

8316.227267632:imrelp.c       : relp session read 415 octets, buf '10
syslog 400 <86>2015-09-03T04:02:57.157111-07:00 <server name would go here>
audispd: type=USER_ROLE_CHANGE msg=audit(1441278177.155:409055): user
pid=2430925 uid=0 auid=0 ses=724350 subj=system_u:base_r:base_t msg='pam:
default-context=user_u:base_r:base_t selected-context=user_u:base_r:base_t
exe="/usr/sbin/sshd" hostname=<IPV6 address would go here> addr=<IPV6
address would go here> terminal=ssh res=success'
'
8316.227278549:imrelp.c       : relp engine is dispatching frame with
command 'syslog'
8316.227281695:imrelp.c       : in 'syslog' command handler
8316.227289495:imrelp.c       : main Q: qqueueAdd: entry added, size now
log 8, phys 9 entries
8316.227292978:imrelp.c       : main Q: EnqueueMsg advised worker start
rsyslogd: ath.c:193: _gcry_ath_mutex_lock: Assertion `*lock ==
((ath_mutex_t) 0)' failed.


Something else strange to note is that everytime I run rsyslog with
valgrind (sudo valgrind --log-fd=1 rsyslogd -nd), I can never get this
crash to happen.  100% of the time, without valgrind, it will crash.


More information about the rsyslog-notify mailing list