[syslog-ng] syslog-ng af_sql driver experiencing segfault

Matthew Hall mhall at mhcomputing.net
Mon Feb 7 19:08:57 CET 2011


On Sun, Feb 06, 2011 at 10:34:41AM +0100, Balazs Scheidler wrote:
> On Fri, 2011-02-04 at 15:27 -0800, Matthew Hall wrote:
> > Program received signal SIGSEGV, Segmentation fault.
> > [Switching to Thread 0xf7b12b90 (LWP 23608)]
> > 0x00c5c7dc in memcpy () from /lib/libc.so.6
> > (gdb) bt
> > #0  0x00c5c7dc in memcpy () from /lib/libc.so.6
> > #1  0xf7e21fed in g_string_insert_len () from /home/y/lib/libglib-2.0.so.0
> > #2  0xf7e223e8 in g_string_append_len () from /home/y/lib/libglib-2.0.so.0
> > #3  0xf7edc1d6 in result_append (result=0x8cc1780, sstr=0x910ffaf "", len=3160627, escape=0) at templates.c:213
> > #4  0xf7ede535 in log_template_append_format_with_context (self=0x8ba0098, messages=0xf7b12204, num_messages=1, opts=0x8bb8aec, tz=1, seq_num=945, result=0x8cc1780) at templates.c:1058
> > #5  0xf7ede83f in log_template_append_format (self=0x8ba0098, lm=0x90d93b0, opts=0x8bb8aec, tz=1, seq_num=945, result=0x8cc1780) at templates.c:1109
> > #6  0xf7ede898 in log_template_format (self=0x8ba0098, lm=0x90d93b0, opts=0x8bb8aec, tz=1, seq_num=945, result=0x8cc1780) at templates.c:1116
> > #7  0xf7b459e6 in afsql_dd_insert_db (self=0x8bb8a58) at afsql.c:681
> > #8  0xf7b45fd9 in afsql_dd_database_thread (arg=0x8bb8a58) at afsql.c:823
> > #9  0xf7ed1405 in worker_thread_func (st=0x8ba4238) at misc.c:593
> > #10 0xf7e28c51 in ?? () from /home/y/lib/libglib-2.0.so.0
> > #11 0x08ba4238 in ?? ()
> > #12 0x08ba4248 in ?? ()
> > #13 0x00000005 in ?? ()
> > #14 0xf7e28b06 in ?? () from /home/y/lib/libglib-2.0.so.0
> > #15 0x00d352c6 in ?? () from /lib/libpthread.so.0
> > #16 0x00000000 in ?? ()
> > (gdb) 
> > 
> > Looks like I am running into problems with the database code.
> > 
> > I'll investigate but it's going to take a while so I hope somebody else might have an idea.
> 
> Not nice. Can you send me the core file and the binaries in private? The
> length of the string to be appended to the result certainly looks
> suspicios being 3160627 bytes.

I can't send the core because it will have PII. If I try to reproduce it 
I might not be able to get it to happen without using real data. But 
I'll see if I can do it.

I can definitely investigate anything you think would be suspicious or 
run any diagnostics you would like to have.

> Can you show me the template that is being expanded here?

I put the sql related directives below.

> The message syslog-ng is trying to operate on is probably bogus, but in
> order to diagnose I'd probably need the core file.

What did you mean by the message being bogus? If you clarify I might be 
able to track it down and file a better report.

> Bazsi

destination d_database {
    sql(
        type(mysql)
        host("localhost") username("syslog") password("")
        database("syslog") table("syslog")
        flags(dont-create-tables, explicit-commits)
        columns(
            "raw varchar(4000) COLLATE utf8_unicode_ci NOT NULL",
            "device char(45) COLLATE utf8_unicode_ci NOT NULL",
            "msgtype char(60) COLLATE utf8_unicode_ci NOT NULL",
            "msgtime char(60) COLLATE utf8_unicode_ci NOT NULL",
            "src char(45) COLLATE utf8_unicode_ci NOT NULL",
            "xsrc char(45) COLLATE utf8_unicode_ci NOT NULL",
            "user char(40) COLLATE utf8_unicode_ci NOT NULL",
            "relay char(45) COLLATE utf8_unicode_ci NOT NULL",
            "task char(20) COLLATE utf8_unicode_ci NOT NULL",
            "sev char(20) COLLATE utf8_unicode_ci NOT NULL",
            "srcmac char(20) COLLATE utf8_unicode_ci NOT NULL",
            "dst char(45) COLLATE utf8_unicode_ci NOT NULL",
            "xdst char(45) COLLATE utf8_unicode_ci NOT NULL",
            "_group char(40) COLLATE utf8_unicode_ci NOT NULL",
            "action char(25) COLLATE utf8_unicode_ci NOT NULL",
            "svr char(30) COLLATE utf8_unicode_ci NOT NULL",
            "srcport smallint(5) unsigned NOT NULL",
            "xsrcport smallint(5) unsigned NOT NULL",
            "interface char(35) COLLATE utf8_unicode_ci NOT NULL",
            "tx char(15) COLLATE utf8_unicode_ci NOT NULL",
            "rx char(15) COLLATE utf8_unicode_ci NOT NULL",
            "reason char(15) COLLATE utf8_unicode_ci NOT NULL",
            "duration char(15) COLLATE utf8_unicode_ci NOT NULL",
            "protocol char(20) COLLATE utf8_unicode_ci NOT NULL",
            "dstport smallint(5) unsigned NOT NULL",
            "xdstport smallint(5) unsigned NOT NULL",
            "method char(25) COLLATE utf8_unicode_ci NOT NULL",
            "acl char(40) COLLATE utf8_unicode_ci NOT NULL",
            "status char(30) COLLATE utf8_unicode_ci NOT NULL",
            "ap char(15) COLLATE utf8_unicode_ci NOT NULL",
            "dstdns varchar(1000) COLLATE utf8_unicode_ci NOT NULL",
            "time char(50) COLLATE utf8_unicode_ci NOT NULL",
            "apmac char(15) COLLATE utf8_unicode_ci NOT NULL",
            "zone char(15) COLLATE utf8_unicode_ci NOT NULL",
            "vlan smallint(5) unsigned NOT NULL",
            "trunk char(35) COLLATE utf8_unicode_ci NOT NULL",
            "snmp char(25) COLLATE utf8_unicode_ci NOT NULL",
            "role char(15) COLLATE utf8_unicode_ci NOT NULL",
            "level char(15) COLLATE utf8_unicode_ci NOT NULL",
            "dstmac char(20) COLLATE utf8_unicode_ci NOT NULL",
            "count int(11) NOT NULL",
            "attack varchar(600) COLLATE utf8_unicode_ci NOT NULL",
            "activity char(15) COLLATE utf8_unicode_ci NOT NULL",
            "ssid char(35) COLLATE utf8_unicode_ci NOT NULL",
            "srcid char(25) COLLATE utf8_unicode_ci NOT NULL",
            "offset char(15) COLLATE utf8_unicode_ci NOT NULL",
            "interface1 char(35) COLLATE utf8_unicode_ci NOT NULL",
            "interface2 char(35) COLLATE utf8_unicode_ci NOT NULL",
            "file char(30) COLLATE utf8_unicode_ci NOT NULL",
        )
        values(
            "$raw", "$device", "$msgtype", "$msgtime", "$src", "$xsrc",
            "$user", "$relay", "$task", "$sev", "$srcmac", "$dst",
            "$xdst", "$group", "$action", "$svr", "$srcport", "$xsrcport",
            "$interface", "$tx", "$rx", "$reason", "$duration", "$protocol",
            "$dstport", "$xdstport", "$method", "$acl", "$status", "$ap",
            "$dstdns", "$time", "$apmac", "$zone", "$vlan", "$trunk",
            "$snmp", "$role", "$level", "$dstmac", "$count", "$attack",
            "$activity", "$ssid", "$srcid", "$offset", "$interface1", "$interface2",
            "$file",
        )
        indexes("date", "device", "level_num", "host", "r_date")
    );
};

parser p_database { db-parser(file("/.../database.xml")); };

template t_raw {
    template("${MSGONLY}\n");
};

rewrite r_strip_empty_values {
    subst('\b(\w+)="" ', "", value(MESSAGE), flags("global"), type("pcre"));
};

destination d_raw {
    file(".../raw/raw_${YEAR}-${MONTH}-${DAY}.log"
         owner("root")
         group("root")
         perm(0640)
         create_dirs(no)
         template(t_raw) suppress(3)
    );
};

destination d_vpn_analysis {
    program("... perl code ..."
            flags(no-multi-line)
            suppress(0)
            template(t_raw)
    );
};

log {
    source(s_tcp);
    parser(p_database);
    destination(d_database);
    rewrite(r_strip_empty_values);
    destination(d_raw);
    destination(d_vpn_analysis);
};


More information about the syslog-ng mailing list