[Bug 252] New: Syslog-NG crashes with destination using unix-dgram() driver
https://bugzilla.balabit.com/show_bug.cgi?id=252 Summary: Syslog-NG crashes with destination using unix-dgram() driver Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: marc.falzon@cloudwatt.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=82) --> (https://bugzilla.balabit.com/attachment.cgi?id=82) syslog-ng.conf Hello I'm facing a Syslog-NG crash when trying to use a unix-dgram() driver as log destination (configuration used is attached to this issue): # syslog-ng -Fev Module loaded and initialized successfully; module='system-source' Module loaded and initialized successfully; module='afsocket' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='syslogformat' Segmentation fault # Service starts successfully if the log path using the d_local destination is commented. Version used (platform: Linux Ubuntu Precise 12.04): # syslog-ng -V syslog-ng 3.4.2 Installer-Version: 3.4.2 Revision: 3.4.2-1~mhp1.sysvinit~precise [@3b56ec1] (Ubuntu/12.04) Compile-Date: Jun 4 2013 16:52:14 Available-Modules: syslogformat,afprog,basicfuncs,confgen,afsocket-notls,afsocket,afsocket-tls,dbparser,cryptofuncs,csvparser,affile,afuser,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on # uname -a Linux p-xxxxxx-0000 3.2.0-51-generic #77-Ubuntu SMP Wed Jul 24 20:18:19 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux # Let me know if you need any more information about my setup and/or configuration. Regards, m. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 Sandor Geller <sandor.geller@morganstanley.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sandor.geller@morganstanley. | |com --- Comment #1 from Sandor Geller <sandor.geller@morganstanley.com> 2013-09-04 14:36:49 --- I doubt using unix-dgram is the issue as it just works fine normally - however your config tries to read from and write to /dev/log so it is definitely buggy. Printing an error message and quitting would be better behaviour though. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 Marc Falzon <marc.falzon@cloudwatt.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |marc.falzon@cloudwatt.com --- Comment #2 from Marc Falzon <marc.falzon@cloudwatt.com> 2013-09-04 14:42:03 --- My setup aims at sourcing external log files to re-inject them into syslog-ng via the /dev/log socket , so that I can manipulate/forward the external log files the same way I do for applications capable of logging directly into syslog. How is that buggy? m. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon@balabit.hu AssignedTo|bazsi@balabit.hu |algernon@balabit.hu -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 --- Comment #3 from Sandor Geller <sandor.geller@morganstanley.com> 2013-09-04 15:06:44 --- Remove system() from your sources as on linux it adds /dev/log and you've got another syslog daemon reading it, right? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 --- Comment #4 from Marc Falzon <marc.falzon@cloudwatt.com> 2013-09-04 15:08:22 --- No I have only one syslog-ng daemon on the host. m. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 --- Comment #5 from Sandor Geller <sandor.geller@morganstanley.com> 2013-09-04 15:11:59 --- Then why are you trying to reinject the message? You should simply divert it to the wanted destination not to /dev/log (which could cause a logging loop however syslog-ng has some protection preventing loops). -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 --- Comment #6 from Marc Falzon <marc.falzon@cloudwatt.com> 2013-09-04 15:21:10 --- We have a bunch a log files that are written directly to files by applications that cannot write to syslog directly using syscall syslog(). These files are not seen by the syslog-ng daemon at all, and what I'm trying to do is actually to tail them by the syslog-ng daemon so it can tag them and write them into the /dev/log sock, so that the thread listening to /dev/log (in source s_local with system()) receives the external applications logs the same way applications writing directly to syslog do. I have a filtering pipeline in my syslog-ng setup, then I write some logs locally and I send most of them to a remote loghost: I don't want to write as many log paths sending directly logs to the remote loghost as I have the external applications. Is it clearer that way? m. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 --- Comment #7 from Sandor Geller <sandor.geller@morganstanley.com> 2013-09-04 15:31:13 --- It is clear what you're trying to achieve but you implemented it in a bad way. You can't pass messages to threads this way. syslog-ng has a central queue so logs read from files are there already so there is no need for reinjecting. Simply write these logs to the final destination (local logfiles, remote hosts, whatever you like) and you're done. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 --- Comment #8 from Gergely Nagy <algernon@balabit.hu> 2013-10-09 16:22:01 --- I think I managed to reproduce the problem. It appears to be a bit strange, as the backtrace says it is segfaulting during plugin loading... -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|ASSIGNED |RESOLVED --- Comment #9 from Gergely Nagy <algernon@balabit.hu> 2013-10-09 16:48:43 --- Found the issue, fixed it in git, with the following patch: https://github.com/balabit/syslog-ng-3.4/commit/1b99bf02f6656f13b6bf2905391a... -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=252 --- Comment #10 from Marc Falzon <marc.falzon@cloudwatt.com> 2013-10-09 17:45:32 --- Haven't tried it out yet, but thank you! -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla＠bugzilla.balabit.com