<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>----- Original message -----
<br>> On 07/14/2011 03:16 AM, Balazs Scheidler wrote:
<br>> > On Sat, 2011-06-25 at 04:49 -0400, JP Vossen wrote:
<br>>
<br>> > > > On Mon, 2011-06-20 at 20:59 +0100, Jose Pedro Oliveira wrote:
<br>> > > > > There is a problem with the hash table implementation of glib2
<br>> > > > > version 2.12.3-4 (version that ships in RHEL 5.x).
<br>> > > > > More details in:
<br>> > > > > * <a href="https://bugzilla.redhat.com/show_bug.cgi?id=714409#c7">https://bugzilla.redhat.com/show_bug.cgi?id=714409#c7</a>
<br>>
<br>> [...]
<br>>
<br>> > > Is this hash problem going to cause critical failures?  Under what
<br>> > > circumstances?  Or is it, well, it'd be nice if that hash problem
<br>> > > didn't happen, but it's not a big deal...
<br>> >
<br>> > Well, it probably mostly depends on why the hashtable collides in that
<br>> > glib version. This hash is a global hash that maps name-value pairs to
<br>> > their own unique IDs, which is then used to track name-value pairs in
<br>> > log messages.
<br>>
<br>> Sorry if I am being dense.  What name-value pairs used for what?  Would
<br>> this impact a basic syslog-ng config that emulates the sysklogd config?
<br>>  What syslog-ng features need to be in use to trigger this?
<br>
<br>For syslog-ng a log message is a set of name-value pairs. Basic syslog properties like $HOST or $MSG as well. The only exceptions are the $PRI and $DATE fields.
<br>
<br>But syslog-ng uses hash tables for a number of other things, so this can cause other bugs as well.
<br>
<br>>
<br>>
<br>> > In case the hash table returns non-matching elements, it means that two
<br>> > (or more) different name-value pairs will map to the same id,
<br>> > effectively one overwriting the other. Whether it happens in practice
<br>> > actually depends on what the exact bug in glib is.
<br>>
<br>> Given how old CentOS-5 is, I wonder that this hasn't been noticed and
<br>> reported before now.  Perhaps that means it's rare to hit it in
<br>> practice?  Or maybe just really hard to identify the root cause.
<br>>
<br>
<br>I think the misbehaviour is difficult to notice, and the root cause is not easy either.
<br>
<br>I've checked the glib history, but I've found no patch that jumped out.
<br>
<br>--
<br>Bazsi<br></p>
</body>
</html>