[Bug 162] New: Invalid frame header; header=''
https://bugzilla.balabit.com/show_bug.cgi?id=162 Summary: Invalid frame header; header='' Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: yuri@fused.com Type of the Report: bug Estimated Hours: 0.0 Got always reproducible bug when sending huge logs between machines. Here are the steps: * setup default OSE installs of client & server on rhel5 * configure client to read file("/tmp/input" flags(no-parse)) and send it to syslog(transport("tcp")) * configure server to listen on syslog(transport(tcp)) and store messages in file() * Now let client send big chunk of data: ruby -e 'loop { puts (97+rand(26)).chr*250 }' | head -1000 >> /tmp/input * See on server the following message: syslog-ng[xxx]: Invalid frame header; header='' server's RSTing the connection afterwards It doesn't happen when you start with a couple of lines and then raise the "chunk" to 100-1000 messages per insertion. If you need more info, ask. Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=162 Yuri Arabadji <yuri@fused.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|3.4.x |3.3.x --- Comment #1 from Yuri Arabadji <yuri@fused.com> 2012-02-16 19:41:20 --- syslog-ng 3.3.4 Installer-Version: 3.3.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.3#master#5e44eb46b0d7b86b62f17698e2b6de875ac8d7c6 Compile-Date: Feb 15 2012 15:53:46 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Available-Modules: convertfuncs,dummy,afsocket-tls,afuser,afsocket,dbparser,afmongodb,confgen,afprog,basicfuncs,syslogformat,csvparser,affile Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: off Enable-Pcre: on -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=162 --- Comment #2 from Yuri Arabadji <yuri@fused.com> 2012-02-16 20:23:22 --- totally forgot to mention. The client is configured to set 2 SDATA headers: set("test.domain.com", value(".SDATA.Apache.Hostname")); set("yes", value(".SDATA.Apache.AccessLog")); Looks like the behaviour is triggered only when they're present. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=162 --- Comment #3 from Yuri Arabadji <yuri@fused.com> 2012-02-16 21:10:25 --- Sorry to write so many comments, but here's what I've additionally found. It doesn't matter whether SDATA is present or not. The problem is that client doesn't prepend string length number after sending 63 properly formatted messages. And, of course, after that, server closes connection. Here's what it looks like on the wire: 223 <13>1 2012-02-16T10:46:19.393-05:00 srv1 - - - blah 223 <13>1 2012-02-16T10:46:19.393-05:00 srv1 - - - blah <13>1 2012-02-16T10:46:20.396-05:00 srv1 - - - blah 225 <13>1 2012-02-16T10:46:20.396-05:00 srv1 - - - blah 225 <13>1 2012-02-16T10:46:21.396-05:00 srv1 - - - blah notice the 3rd line. It's easily reproducible with 3.3.4 and 3.0.9 and I don't quite get why it wasn't caught. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=162 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon@balabit.hu Status|NEW |ASSIGNED --- Comment #4 from Gergely Nagy <algernon@balabit.hu> 2012-02-17 13:15:50 --- This is something I've seen too, and a collegue of mine made a fix, too, which is available at https://github.com/algernon/syslog-ng/tree/hotfix/3.3/syslog-proto-framing-f... The problem is, the patch is very ugly, and Bazsi rejected it, so it needs to be reworked a bit, and I didn't get around to do that yet. In the meantime, the patch above should do the trick. I've been using it for a while now, and it broke nothing, and the problem is gone. It's very ugly, though. Hope that helps! -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=162 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bazsi@balabit.hu |algernon@balabit.hu Status|ASSIGNED |NEW -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=162 Balazs Scheidler <bazsi@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bazsi@balabit.hu Resolution| |FIXED Status|NEW |RESOLVED --- Comment #5 from Balazs Scheidler <bazsi@balabit.hu> 2012-03-12 20:25:30 --- This patch is somewhat better and my testing shows that it also fixes the problem: commit fd3b3863003da213eb45c4cd744aadb926a2ec98 Author: Balazs Scheidler <bazsi@balabit.hu> Date: Mon Mar 12 20:24:31 2012 +0100 LogProto: fixed framing error on partial flushes in RFC5424 support This patch fixes bug that is triggered when syslog-ng receives an EAGAIN while payload is written to the destination. A patch fixing the issue was submitted by Gergely Nagy, however I didn't like that solution refactored the code to something more manageable. Reported-By: Yuri Arabadji <yuri@fused.com> Signed-off-by: Fried Zoltan <deirf@balabit.hu> Signed-off-by: Gergely Nagy <algernon@balabit.hu> Signed-off-by: Balazs Scheidler <bazsi@balabit.hu> -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla＠bugzilla.balabit.com