<p dir="ltr">This seems to be an assertion failure in logmsg.c line 535</p>
<p dir="ltr">Unfortunately I cannot tell what assertion as I don't have the code handy on my phone, but I thought I'd share.</p>
<div class="gmail_quote">On Jul 23, 2015 17:33, "Clayton Dukes" <<a href="mailto:cdukes@gmail.com">cdukes@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Has anyone seen this or know what may be causing it? When I run a stack trace, I can see that this host causes syslog-ng to crash every time it sends a message<div><br></div><div>I've run a couple of tcpdumps and it *seems* to be caused by an ARP request from a Cyclades box. This seems very odd to me of course.</div><div><br></div><div>10<span style="white-space:pre-wrap"> </span>130.085308<span style="white-space:pre-wrap"> </span>Cyclades_01:be:4b<span style="white-space:pre-wrap"> </span>SuperMic_9a:58:be<span style="white-space:pre-wrap"> </span>ARP<span style="white-space:pre-wrap"> </span>60<span style="white-space:pre-wrap"> </span>Who has x.x.188.52? Tell x.x.188.11<br></div><div><br></div><div>The *only* other packets from that host are repeated so they don't seem to be the cause:</div><div><br></div><div>4<span style="white-space:pre-wrap"> </span>1.000259<span style="white-space:pre-wrap"> </span>x.x.188.11<span style="white-space:pre-wrap"> </span>x.x.188.52<span style="white-space:pre-wrap"> </span>Syslog<span style="white-space:pre-wrap"> </span>257<span style="white-space:pre-wrap"> </span>LOCAL0.NOTICE: Jul 23 11:04:05 src_dev_log@ACS-01 Buffering: S12.Server-Farm-6509-01 [Jul 23 11:04:03.267 EDT: %MCAST-SP-3-QUERY_INT_MISMATCH: Snooping Querier received a non-matching query interval (125000 msec),]\n<br><div><br></div><div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28379] recvfrom(9, "<133>Jul 23 10:19:58 src_dev_log"..., 8192, 0, {sa_family=AF_INET, sin_port=htons(3284), sin_addr=inet_addr("x.x.188.11")}, [16]) = 181</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28379] stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28379] mprotect(0x7f956c346000, 12288, PROT_READ|PROT_WRITE) = 0</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28379] write(2, "**\nERROR:../../lib/logmsg.c:535:"..., 114) = 114</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28379] rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28379] tgkill(28374, 28379, SIGABRT) = 0</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28379] --- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=28374, si_uid=0} ---</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28379] +++ killed by SIGABRT (core dumped) +++</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28434] +++ killed by SIGABRT (core dumped) +++</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">[pid 28428] +++ killed by SIGABRT (core dumped) +++</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New">+++ killed by SIGABRT (core dumped) +++</font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New"><br></font></div><div style="color:rgb(0,0,0);font-family:Calibri;font-size:14px"><font face="Courier New"><br></font></div><div><div>______________________________________________________________ <br><br>Clayton Dukes<br>______________________________________________________________</div></div>
</div></div></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>