[Bug 256] New: rewrite + subst make syslog-ng crash
https://bugzilla.balabit.com/show_bug.cgi?id=256 Summary: rewrite + subst make syslog-ng crash Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: nico@rottenbytes.info Type of the Report: bug Estimated Hours: 0.0 Hi, I've been using syslog-ng 3.4.4 (from madhouse-project debian packages) and I'm getting crashes of the daemon on rewrite rules. here is the scheme : rewrite r_services { subst("postfix/.*", "postfix", value("PROGRAM"), flags("global")); subst("nagios.*", "nagios", value("PROGRAM"), flags("global")); subst("jftpgw", "ftp-proxy", value("PROGRAM"), flags("global")); subst("ftp-child", "ftp-proxy", value("PROGRAM"), flags("global")); }; log { source(s_local); source(s_remote); rewrite(r_services); filter(f_services); destination(df_services); flags(final); }; will make the daemon crash. rewrite + set rules are NOT impacted and work fine. Using rewrite + set and a condition will work too for example : rewrite r_services { set("postfix", value("PROGRAM") condition(program("postfix/.*"))); }; works. When the program crashes I get the following error : ERROR:../../../lib/logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Feel free to contact me if you need more details. Regards -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=256 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon@balabit.hu AssignedTo|bazsi@balabit.hu |algernon@balabit.hu -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=256 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=256 --- Comment #1 from Gergely Nagy <algernon@balabit.hu> 2013-10-23 13:06:31 --- Managed to reproduce this, with the following config: @version: 3.4 source s_main { unix-stream("var/input.sock"); }; rewrite r_services { subst("postfix/.*", "postfix", value("PROGRAM"), flags("global")); subst("nagios.*", "nagios", value("PROGRAM"), flags("global")); subst("jftpgw", "ftp-proxy", value("PROGRAM"), flags("global")); subst("ftp-child", "ftp-proxy", value("PROGRAM"), flags("global")); }; destination d_null { file("/tmp/null.log"); }; destination d_blah { file("/tmp/blah.log"); }; log { source(s_main); rewrite(r_services); destination(d_null); flags(final); }; log { source(s_main); destination(d_blah); }; Without the second log{} block, the crash does not happen. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=256 --- Comment #2 from Gergely Nagy <algernon@balabit.hu> 2013-10-23 13:48:46 --- I have a possible solution, it's available here https://github.com/algernon/syslog-ng/commit/bb5deb1e9b6e40920ec5c0d2cbb95a6... (and on my hotfix/3.4/subst-writable branch on github). I'm not a hundred percent sure that this is the right solution, as it may clone the message even when it doesn't have to, but I have not studied this part of the code in a while. Can you give it a go, if it works for you? @Bazsi: I'd love to have your input on the patch, too. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=256 Balazs Scheidler <bazsi@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bazsi@balabit.hu --- Comment #3 from Balazs Scheidler <bazsi@balabit.hu> 2013-10-23 20:39:47 --- for now it is the proper fix, however it'll degrade performance a bit, as it'll clone messages even if the subst() pattern doesn't match... I am pondering of a refactor of the LogMatcher code: - decouple it from LogMessage (and perhaps rename it to something without the Log prefix) - use callbacks (in as similar vein to ValuePairs) to return values to be added to the log message Once that refactor is in place, we could delay the log_msg_make_writable() call into the callback, right now $0, $1 and so on are added to the LogMessage as the replacement template may reference them. it doesn't right now, but we don't know that. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=256 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|ASSIGNED |RESOLVED --- Comment #4 from Gergely Nagy <algernon@balabit.hu> 2013-10-24 10:43:34 --- Applied the patch to 3.4 and 3.5 master, we'll deal with the refactoring in 3.6. Thanks! -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla＠bugzilla.balabit.com