[syslog-ng] syslog-ng OSE 3.0.4 coredumps when use "internal()" in s_local

[Balazs Scheidler]

On Wed, 2009-12-09 at 18:04 +0000, nova club wrote:
> Hi there,
> 
> I am a new user of syslog-ng. Thanks for your time and attention in
> advance.
> 
> The problem is syslog-ng coredumps when use "internal()" in "source",
> however it will work fine without "internal()". The conf file is like:


hmm... g_malloc() never fails, it aborts() instead after logging the
failure using assert.

This assert is then caught by syslog-ng, to be put in the internal()
message source , but then again allocation fails, thus the segfault.

Are you sure that syslog-ng is not severely constrained by ulimit or
something?

Generally if memory allocation fails, syslog-ng aborts.

Ah, as I see you said the core file is large, this seems to be some kind
of memory leak, or overuse of memory, and that's the root reason of the
crash.

Can you send me your complete configuration file? Maybe we could
reproduce the problem. Do you happen to have large log_fifo_size()
configured to one of your destinations?

> 
> ===>BEGIN
> @version:3.0
> 
> options { dir_perm(0755); perm(0644);
>           chain_hostnames(no);
>           keep_hostname(yes);
>           };
> 
> # Default local source.
> source local {
>         unix-dgram("/var/run/log");
>         unix-dgram("/var/run/logpriv" perm(0600));
>         internal();
>         file("/dev/klog");
> };
> 
> ...
> 
> filter f_hecxd { program("hecxd"); };
> 
> ...
> 
> log { source(local); filter(f_hecxd); destination(d_hecxd); };
> ==>END
> 
> The options used for building syslog-ng is: 
>  
>    CFLAGS='-Wl,-Bdynamic -liconv -Wl,-Bstatic' --enable-static-linking
> \
>    --enable-debug \
>    --enable-ssl --enable-ipv6=no --enable-tcp-wrapper=no \
>    --with-pidfile-dir="/var/run/"
> 
> The platform is: FREEBSD 6.4-RELEASE-p6 i386
> 
> I got a very big core dump file (>500M), by backtracing that file, I
> can see the problem is "g_malloc0" for some reason failed to allocate
> memory, while syslog-ng did not check the return value and tried to
> use the "0x0" pointer in a "strlen()" call later. Here is a part of
> trace information:
> 
> #0  0x080a2d8d in strlen ()
> No symbol table info available.
> #1  0x0804e7fe in log_msg_new_internal (prio=43, msg=0x0, flags=6) at
> logmsg.c:1971
>         buf = (gchar *) 0x0
>         self = (LogMessage *) 0x8159000
> #2  0x080492b1 in msg_send_internal_message (prio=43, msg=0x0) at
> messages.c:128
>         context = (MsgContext *) 0x81893a0
>         m = (LogMessage *) 0x7
> #3  0x0804954c in msg_log_func (log_domain=0x81186ea "GLib",
> log_flags=6, msg=0x0, user_data=0x0) at messages.c:187
>         pri = 43
> #4  0x08084906 in IA__g_logv (log_domain=0x81186ea "GLib",
> log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate
> %u bytes",
>     args1=0xbfbfe6cc "3�\021\bl") at gmessages.c:519
>         msg = (gchar *) 0x0
>         was_fatal = 0
>         was_recursion = 0
>         i = 2
> #5  0x08084ae4 in IA__g_log (log_domain=0x81186ea "GLib",
> log_level=G_LOG_LEVEL_ERROR, format=0x811cbac "%s: failed to allocate
> %u bytes")
>     at gmessages.c:569
> No locals.
> #6  0x08084239 in IA__g_malloc0 (n_bytes=108) at gmem.c:155
>         mem = 0x0
> #7  0x0804e5ef in log_msg_new (
>     msg=0x8a82180 "<47> syslog-ng[3277]: Filter node evaluation
> result; filter_result='not-match', filter_type='level'\n", length=100,
>     saddr=0x0, flags=6, bad_hostname=0x0, assume_timezone=-1,
> default_pri=47) at logmsg.c:1873
>         self = (LogMessage *) 0x810ba1b
> #8  0x0804e80a in log_msg_new_internal (prio=47,
>     msg=0x817f500 "Filter node evaluation result;
> filter_result='not-match', filter_type='level'", flags=6) at
> logmsg.c:1971
>         buf = (gchar *) 0x8a82180 "<47> syslog-ng[3277]: Filter node
> evaluation result; filter_result='not-match', filter_type='level'\n"
>         self = (LogMessage *) 0x8159000
> #9  0x080492b1 in msg_send_internal_message (prio=47,
>     msg=0x817f500 "Filter node evaluation result;
> filter_result='not-match', filter_type='level'") at messages.c:128
>         context = (MsgContext *) 0x81893a0
>         m = (LogMessage *) 0x8182030
> 
> If you need the completed coredump file, just let me know and tell me
> where to put it :)
> 
> Any help is much appreciated.
> 
> Thanks a lot.
> Shen
> 
> 
> 
> 
> ______________________________________________________________________
> Windows Live: Make it easier for your friends to see what you’re up to
> on Facebook.
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 


-- 
Bazsi