<div dir="ltr"><div><div><div>Hi,<br></div><br>Yes. Going back to an older kernel resolved (worked around...) the problem.<br><br></div>Thank you and have a nice weekend!<br><br></div><div>CzP<br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Peter Czanik (CzP) <<a href="mailto:peter.czanik@balabit.com" target="_blank">peter.czanik@balabit.com</a>><br>Balabit / syslog-ng upstream<br><a href="https://www.balabit.com/blog/author/peterczanik/" target="_blank">https://www.balabit.com/blog/author/peterczanik/</a><br><a href="https://twitter.com/PCzanik" target="_blank">https://twitter.com/PCzanik</a></div></div></div></div>
<br><div class="gmail_quote">On Fri, Jun 23, 2017 at 2:18 PM, Sandor Geller <span dir="ltr"><<a href="mailto:sandor.geller@ericsson.com" target="_blank">sandor.geller@ericsson.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<div class="m_-5205495392158560538moz-cite-prefix">Hi,<br>
<br>
Are you using recent kernels? The enhanced stack protection fixing
CVE-2017-1000364 causes interoperability issues for certain Java
apps...<br>
<br>
Regards,<br>
<br>
Sandor<div><div class="h5"><br>
<br>
On 06/23/2017 02:12 PM, Czanik, Péter wrote:<br>
</div></div></div>
<blockquote type="cite"><div><div class="h5">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>Hi,<br>
<br>
</div>
I wanted to send some logs to Elasticsearch, but I did
not succeed. Syslog-ng crashed. Actually it seems to be
something JVM related. A bit too many things changed
recently in my test environment:<br>
</div>
- a new laptop<br>
</div>
- a new version of vmware workstation<br>
</div>
- a new version of glibc and openjdk inside the vm-s (I always
start with a security update...)<br>
</div>
<br>
The problem appeared both with syslog-ng 3.9 and 3.10 on both
openSUSE Leap and CentOS 7.<br>
<div><br>
</div>
<div>Have you ever seen anything similar?<br>
<br>
</div>
<div>Bye,<br>
</div>
<div>CzP<br>
</div>
<div><br>
</div>
<div>This one is from CentOS7 where I already tried rolling back
glibc and openjdk:<br>
</div>
<div><br>
[2017-06-23T13:25:22.816610] Compiling d_elastic reference
[destination] at [/etc/syslog-ng/conf.d/es2.<wbr>conf:27:3]<br>
[2017-06-23T13:25:22.816968] Seeking the journal to the start
position;<br>
[2017-06-23T13:25:22.817808] Processing the time zone file
(32bit part); filename='/usr/share/zoneinfo/<wbr>UTC'<br>
#<br>
# A fatal error has been detected by the Java Runtime
Environment:<br>
#<br>
# SIGBUS (0x7) at pc=0x00007f5ecc511c18, pid=1651,
tid=0x00007f5ee3949b40<br>
#<br>
# JRE version: (8.0_121-b13) (build )<br>
# Java VM: OpenJDK 64-Bit Server VM (25.121-b13 mixed mode
linux-amd64 compressed oops)<br>
# Problematic frame:<br>
# j java.lang.Object.<clinit>()V+0<br>
#<br>
# Failed to write core dump. Core dumps have been disabled. To
enable core dumping, try "ulimit -c unlimited" before starting
Java again<br>
#<br>
# An error report file with more information is saved as:<br>
# /tmp/hs_err_pid1651.log<br>
#<br>
# If you would like to submit a bug report, please visit:<br>
# <a href="http://bugreport.java.com/bugreport/crash.jsp" target="_blank">http://bugreport.java.com/<wbr>bugreport/crash.jsp</a><br>
#<br>
Aborted (core dumped)<br>
<br>
<br>
</div>
<div>This one is from openSUSE, where I had gdb installed...<br>
</div>
<div><br>
linux-pzl9:/var/lib/systemd/<wbr>coredump # gdb -c
core.syslog-ng.0.<wbr>46a0d0e824ce4fa29a644ef7130640<wbr>44.2015.1498211596000000
/usr/sbin/syslog-ng<br>
GNU gdb (GDB; openSUSE Leap 42.2) 7.11.1<br>
Copyright (C) 2016 Free Software Foundation, Inc.<br>
License GPLv3+: GNU GPL version 3 or later <<a href="http://gnu.org/licenses/gpl.html" target="_blank">http://gnu.org/licenses/gpl.<wbr>html</a>><br>
This is free software: you are free to change and redistribute
it.<br>
There is NO WARRANTY, to the extent permitted by law. Type
"show copying"<br>
and "show warranty" for details.<br>
This GDB was configured as "x86_64-suse-linux".<br>
Type "show configuration" for configuration details.<br>
For bug reporting instructions, please see:<br>
<<a href="http://bugs.opensuse.org/" target="_blank">http://bugs.opensuse.org/</a>>.<br>
Find the GDB manual and other documentation resources online
at:<br>
<<a href="http://www.gnu.org/software/gdb/documentation/" target="_blank">http://www.gnu.org/software/<wbr>gdb/documentation/</a>>.<br>
For help, type "help".<br>
Type "apropos word" to search for commands related to
"word"...<br>
Reading symbols from /usr/sbin/syslog-ng...(no debugging
symbols found)...done.<br>
[New LWP 2015]<br>
[New LWP 2016]<br>
[New LWP 2017]<br>
[New LWP 2018]<br>
[Thread debugging using libthread_db enabled]<br>
Using host libthread_db library "/lib64/libthread_db.so.1".<br>
Core was generated by `syslog-ng -Fvde'.<br>
Program terminated with signal SIGSEGV, Segmentation fault.<br>
#0 _expand_stack_to (bottom=0x7ffe43f70fff "",
bottom@entry=0x7ffe43f70990 "") at
/usr/src/debug/icedtea-3.4.0/<wbr>openjdk/hotspot/src/os/linux/<wbr>vm/os_linux.cpp:673<br>
673
/usr/src/debug/icedtea-3.4.0/<wbr>openjdk/hotspot/src/os/linux/<wbr>vm/os_linux.cpp:
No such file or directory.<br>
[Current thread is 1 (Thread 0x7ff2ab992b40 (LWP 2015))]<br>
Missing separate debuginfos, use: zypper install
syslog-ng-debuginfo-3.10.1-2.<wbr>3.x86_64<br>
(gdb) bt full<br>
#0 _expand_stack_to (bottom=0x7ffe43f70fff "",
bottom@entry=0x7ffe43f70990 "") at
/usr/src/debug/icedtea-3.4.0/<wbr>openjdk/hotspot/src/os/linux/<wbr>vm/os_linux.cpp:673<br>
sp = 0x7ffe43f7a120 ""<br>
size = 37153<br>
p = 0x7ffe43f70ff0 ""<br>
#1 0x00007ff2a5f6f184 in os::Linux::manually_expand_<wbr>stack
(t=t@entry=0x19e9000, addr=0x7ffe43f70990 "") at
/usr/src/debug/icedtea-3.4.0/<wbr>openjdk/hotspot/src/os/linux/<wbr>vm/os_linux.cpp:686<br>
mask_all = {__val = {18446744067267100671,
18446744073709551615 <repeats 15 times>}}<br>
old_sigset = {__val = {18446744067266838271,
140680142549761, 140730038723104, 140680138113208, 1140303776,
210453397503, 140730038723232, 140730038724512, 1, 27171840,
18446744073709551615, 4, <br>
140730038723200, 140680140758410, 140730038723208,
18446744069414584320}}<br>
#2 0x00007ff2a5f77f7d in JVM_handle_linux_signal (sig=11,
info=0x7ffe43f7a530, ucVoid=0x7ffe43f7a400,
abort_if_unrecognized=1)<br>
at
/usr/src/debug/icedtea-3.4.0/<wbr>openjdk/hotspot/src/os_cpu/<wbr>linux_x86/vm/os_linux_x86.cpp:<wbr>330<br>
addr = <optimized out><br>
uc = 0x7ffe43f7a400<br>
thread = 0x19e9000<br>
stub = 0x0<br>
newset = {__val = {0, 0, 18446744073709551615, 2,
27670976, 140679847562464, 3, 27171760, 27171728,
140679847562559, 140679847562515, 0, 140730038723488,
140680143714222, 3, 140730038724512}}<br>
err = {<StackObj> = {<No data fields>},
_id = 1, _message = 0x19e9c00 "", _detail_msg =
0xffffffffffffffff <error: Cannot access memory at address
0xffffffffffffffff>, _thread = 0x4, <br>
_pc = 0x7ffe43f7a740 "\320\v\177\212\362\177",
_siginfo = 0x7ff2a60051f8<br>
<SharedRuntime::generate_<wbr>i2c2i_adapters(MacroAssembler*<wbr>,
int, int, BasicType const*, VMRegPair const*,
AdapterFingerPrint*)+3464>, _context = 0x3, <br>
_filename = 0xffffffffffffffff <error: Cannot
access memory at address 0xffffffffffffffff>, _lineno = -1,
_current_step = 48, <br>
_current_step_info = 0x7ff2a65619f0 <vtable for
Relocation+16> "\240栥\362\177", _verbose = 0, static
first_error = 0x0, static first_error_tid = -1, static
coredump_status = false, <br>
static coredump_message = '\000' <repeats 1999
times>, _size = 140680227341344, static out =
{<outputStream> = {<ResourceObj> = {<No data
fields>}, <br>
_vptr.outputStream = 0x7ff2a655fc50 <vtable
for fdStream+16>, _indentation = 0, _width = 80, _position
= 0, _newlines = 0, _precount = 0, _stamp = {_counter = 0}},
_fd = 1, _need_close = false}, <br>
static log = {<outputStream> =
{<ResourceObj> = {<No data fields>},
_vptr.outputStream = 0x7ff2a655fc50 <vtable for
fdStream+16>, _indentation = 0, _width = 80, _position = 0,
_newlines = 0, <br>
_precount = 0, _stamp = {_counter = 0}}, _fd =
-1, _need_close = false}}<br>
t = 0x19e9000<br>
shm = {<StackObj> = {<No data fields>},
_thread = 0x19e9000}<br>
vmthread = 0x0<br>
pc = <optimized out><br>
#3 0x00007ff2a5f6e3d8 in signalHandler (sig=11,
info=0x7ffe43f7a530, uc=0x7ffe43f7a400) at
/usr/src/debug/icedtea-3.4.0/<wbr>openjdk/hotspot/src/os/linux/<wbr>vm/os_linux.cpp:4354<br>
orig_errno = 2<br>
#4 <signal handler called><br>
No symbol table info available.<br>
#5 0x00007ff29453dc26 in ?? ()<br>
No symbol table info available.<br>
#6 0x00007ffe43f7a990 in ?? ()<br>
No symbol table info available.<br>
#7 0x00007ff28a7d0d50 in ?? ()<br>
No symbol table info available.<br>
#8 0x00007ffe43f7a9d8 in ?? ()<br>
No symbol table info available.<br>
#9 0x00007ff28a892ff8 in ?? ()<br>
No symbol table info available.<br>
#10 0x0000000000000000 in ?? ()<br>
No symbol table info available.<br>
(gdb) <br>
<br>
<div>
<div>
<div>
<div>
<div><br clear="all">
<div>
<div>
<div class="m_-5205495392158560538gmail_signature">
<div dir="ltr">
<div>Peter Czanik (CzP) <<a href="mailto:peter.czanik@balabit.com" target="_blank">peter.czanik@balabit.com</a>><br>
Balabit / syslog-ng upstream<br>
<a href="https://www.balabit.com/blog/author/peterczanik/" target="_blank">https://www.balabit.com/blog/<wbr>author/peterczanik/</a><br>
<a href="https://twitter.com/PCzanik" target="_blank">https://twitter.com/PCzanik</a></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="m_-5205495392158560538mimeAttachmentHeader"></fieldset>
<br>
</div></div><pre>______________________________<wbr>______________________________<wbr>__________________
Member info: <a class="m_-5205495392158560538moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a>
Documentation: <a class="m_-5205495392158560538moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a>
FAQ: <a class="m_-5205495392158560538moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a>
</pre>
</blockquote>
<p><br>
</p>
</div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>