[syslog-ng] [Bug 260] exit with code 134

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=260





--- Comment #3 from Balazs Scheidler <bazsi at balabit.hu>  2013-11-19 16:22:58 ---
I have now tried to diagnose the root cause for this issue.

Like in the previous core, epoll() returns failure while modifying the I/O interest mask of an fd using EPOLL_CTL_MOD

The fd that fails belongs to a syslog(transport(udp)) source. Memory is seemingly not corrupted.

The interesting part is that ivykis operates with the assumption that the fd had been registered for polling both EPOLLIN and EPOLLOUT but not for EPOLLERR.

The "normal" setting for a UDP source is EPOLLIN and EPOLLERR and I couldn't find a way it'd set the mask to EPOLLIN and EPOLLOUT.

My best guess is that the struct iv_fd "registered_bands" member is corrupted, this theory is supported by the fact that epoll() returns failure, which
generally means that it was not registered at all. But how that can be corrupted is a mystery to me, it is always updated in the same thread.

Can you by chance describe what happens when this happens? Is it always related to reloading syslog-ng?
Is it perhaps possible to run syslog-ng under strace until this happens? It produces a _lot_ of output and increases CPU demand a lot, but might give a clue on
how
syslog-ng is working with the fd in question.

Also, if you happen to have further core files, those could also be helpful. The fact if this always happens with the same fd or not could help.

Thanks in advance.


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.