<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
Thank you so much for your attention. I tried 3.0.5 and it has same problem. Please see the attached tarball consisting of a conf file and static-linked syslog-ng binary.<br><br>The platform I am using is "6.4-RELEASE-p6 FreeBSD 6.4-RELEASE-p6 i386". The command line is like "syslog-ng -f <conf> -d -F". And for now, I have not found any special or abnormal resource "limit" setup on that box. <br><br>Another interesting thing is no coredumps if I use "-e" option too.<br><br>The conf file actually is a copy of "contrib/freebsd-packaging/syslog-ng.conf.example", I just added a new log path for a program called "hecxd".<br><br>Thanks a lot again.<br><br>> From: bazsi@balabit.hu<br>> To: syslog-ng@lists.balabit.hu<br>> Date: Fri, 11 Dec 2009 07:52:02 +0100<br>> Subject: Re: [syslog-ng] syslog-ng OSE 3.0.4 coredumps when use "internal()" in s_local<br>> <br>> On Wed, 2009-12-09 at 18:04 +0000, nova club wrote:<br>> > Hi there,<br>> > <br>> > I am a new user of syslog-ng. Thanks for your time and attention in<br>> > advance.<br>> > <br>> > The problem is syslog-ng coredumps when use "internal()" in "source",<br>> > however it will work fine without "internal()". The conf file is like:<br>> <br>> <br>> hmm... g_malloc() never fails, it aborts() instead after logging the<br>> failure using assert.<br>> <br>> This assert is then caught by syslog-ng, to be put in the internal()<br>> message source , but then again allocation fails, thus the segfault.<br>> <br>> Are you sure that syslog-ng is not severely constrained by ulimit or<br>> something?<br>> <br>> Generally if memory allocation fails, syslog-ng aborts.<br>> <br>> Ah, as I see you said the core file is large, this seems to be some kind<br>> of memory leak, or overuse of memory, and that's the root reason of the<br>> crash.<br>> <br>> Can you send me your complete configuration file? Maybe we could<br>> reproduce the problem. Do you happen to have large log_fifo_size()<br>> configured to one of your destinations?<br>> <br>> > <br>> > ===>BEGIN<br>> > @version:3.0<br>> > <br>> > options { dir_perm(0755); perm(0644);<br>> > chain_hostnames(no);<br>> > keep_hostname(yes);<br>> > };<br>> > <br>> > # Default local source.<br>> > source local {<br>> > unix-dgram("/var/run/log");<br>> > unix-dgram("/var/run/logpriv" perm(0600));<br>> > internal();<br>> > file("/dev/klog");<br>> > };<br>> > <br>> > ...<br>> > <br>> > filter f_hecxd { program("hecxd"); };<br>> > <br>> > ...<br>> > <br>> > log { source(local); filter(f_hecxd); destination(d_hecxd); };<br>> > ==>END<br>> > <br>> > The options used for building syslog-ng is: <br>> > <br>> > CFLAGS='-Wl,-Bdynamic -liconv -Wl,-Bstatic' --enable-static-linking<br>> > \<br>> > --enable-debug \<br>> > --enable-ssl --enable-ipv6=no --enable-tcp-wrapper=no \<br>> > --with-pidfile-dir="/var/run/"<br>> > <br>> > The platform is: FREEBSD 6.4-RELEASE-p6 i386<br>> > <br>> > I got a very big core dump file (>500M), by backtracing that file, I<br>> > can see the problem is "g_malloc0" for some reason failed to allocate<br>> > memory, while syslog-ng did not check the return value and tried to<br>> > use the "0x0" pointer in a "strlen()" call later. Here is a part of<br>> > trace information:<br>> > <br>> > #0 0x080a2d8d in strlen ()<br>> > No symbol table info available.<br>> > #1 0x0804e7fe in log_msg_new_internal (prio=43, msg=0x0, flags=6) at<br>> > logmsg.c:1971<br>> > buf = (gchar *) 0x0<br>> > self = (LogMessage *) 0x8159000<br>> > #2 0x080492b1 in msg_send_internal_message (prio=43, msg=0x0) at<br>> > messages.c:128<br>> > context = (MsgContext *) 0x81893a0<br>> > m = (LogMessage *) 0x7<br>> > #3 0x0804954c in msg_log_func (log_domain=0x81186ea "GLib",<br>> > log_flags=6, msg=0x0, user_data=0x0) at messages.c:187<br>> > pri = 43<br>> > #4 0x08084906 in IA__g_logv (log_domain=0x81186ea "GLib",<br>> > log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate<br>> > %u bytes",<br>> > args1=0xbfbfe6cc "3�\021\bl") at gmessages.c:519<br>> > msg = (gchar *) 0x0<br>> > was_fatal = 0<br>> > was_recursion = 0<br>> > i = 2<br>> > #5 0x08084ae4 in IA__g_log (log_domain=0x81186ea "GLib",<br>> > log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate<br>> > %u bytes")<br>> > at gmessages.c:569<br>> > No locals.<br>> > #6 0x08084239 in IA__g_malloc0 (n_bytes=108) at gmem.c:155<br>> > mem = 0x0<br>> > #7 0x0804e5ef in log_msg_new (<br>> > msg=0x8a82180 "<47> syslog-ng[3277]: Filter node evaluation<br>> > result; filter_result='not-match', filter_type='level'\n", length=100,<br>> > saddr=0x0, flags=6, bad_hostname=0x0, assume_timezone=-1,<br>> > default_pri=47) at logmsg.c:1873<br>> > self = (LogMessage *) 0x810ba1b<br>> > #8 0x0804e80a in log_msg_new_internal (prio=47,<br>> > msg=0x817f500 "Filter node evaluation result;<br>> > filter_result='not-match', filter_type='level'", flags=6) at<br>> > logmsg.c:1971<br>> > buf = (gchar *) 0x8a82180 "<47> syslog-ng[3277]: Filter node<br>> > evaluation result; filter_result='not-match', filter_type='level'\n"<br>> > self = (LogMessage *) 0x8159000<br>> > #9 0x080492b1 in msg_send_internal_message (prio=47,<br>> > msg=0x817f500 "Filter node evaluation result;<br>> > filter_result='not-match', filter_type='level'") at messages.c:128<br>> > context = (MsgContext *) 0x81893a0<br>> > m = (LogMessage *) 0x8182030<br>> > <br>> > If you need the completed coredump file, just let me know and tell me<br>> > where to put it :)<br>> > <br>> > Any help is much appreciated.<br>> > <br>> > Thanks a lot.<br>> > Shen<br>> > <br>> > <br>> > <br>> > <br>> > ______________________________________________________________________<br>> > Windows Live: Make it easier for your friends to see what you’re up to<br>> > on Facebook.<br>> > ______________________________________________________________________________<br>> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<br>> > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng<br>> > FAQ: http://www.campin.net/syslog-ng/faq.html<br>> > <br>> <br>> <br>> -- <br>> Bazsi<br>> <br>> <br>> ______________________________________________________________________________<br>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng<br>> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng<br>> FAQ: http://www.campin.net/syslog-ng/faq.html<br>> <br> <br /><hr />Get a great deal on Windows 7 and see how it works the way you want. <a href='http://go.microsoft.com/?linkid=9691812' target='_new'>Check out the offers on Windows 7now.</a></body>
</html>