rsyslogd crashes when the spool is corrupted
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
rsyslog (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Precise |
Fix Released
|
Medium
|
Chris J Arges | ||
Quantal |
Fix Released
|
Medium
|
Chris J Arges |
Bug Description
[Impact]
When daemonizing, the child process segfaults and the parent acts oddly.
[Test Case]
Edit /etc/rsyslog.conf and /etc/rsyslog.
stop rsyslog
mv /var/spool/rsyslog /var/spool/
tar -xf var-spool-
gdb /usr/sbin/rsyslogd
set follow-fork-mode child
run -c5
(gdb) bt
#0 strmFlushInternal (pThis=0x0) at stream.c:1236
#1 0x00000000004291b9 in strmSerialize (pThis=0x0, pStrm=0x676150) at stream.c:1569
#2 0x000000000042ee02 in qqueuePersist (pThis=0x675a10, bIsCheckpoint=0) at queue.c:2015
#3 0x000000000042f026 in qqueueDestruct (ppThis=0x674d78) at queue.c:2153
#4 0x0000000000432660 in StartDA (pThis=0x674b50) at queue.c:353
#5 InitDA (pThis=0x674b50, bLockMutex=
#6 qqueueStart (pThis=0x674b50) at queue.c:1914
#7 0x0000000000437987 in actionConstruct
#8 0x000000000043977e in addAction (ppAction=
at ../action.c:1779
#9 0x0000000000416934 in cflineDoAction (ppAction=
#10 cflineClassic (ppRule=
#11 cfline (line=<optimized out>, pfCurr=
#12 0x00000000004171a5 in processConfFile (pConfFile=0x671af0 "/etc/rsyslog.
#13 0x0000000000417586 in doIncludeLine (pp=<optimized out>, pVal=<optimized out>) at conf.c:234
#14 0x0000000000435771 in cslchCallHdlr (ppConfLine=
#15 processCfSysLin
#16 0x00000000004166b1 in cfsysline (p=0x7fffffffa99f "/etc/rsyslog.
#17 0x0000000000416a29 in cfline (line=0x7ffffff
#18 0x00000000004171a5 in processConfFile (pConfFile=0x44204c "/etc/rsyslog.
#19 0x000000000040aa53 in init () at syslogd.c:1620
#20 0x000000000040e0ce in mainThread () at syslogd.c:2179
#21 realMain (argc=<optimized out>, argv=<optimized out>) at syslogd.c:2914
#22 0x00007ffff71fc76d in __libc_start_main (main=0x40af80 <main>, argc=2, ubp_av=
fini=<optimized out>, rtld_fini=
#23 0x000000000040afc9 in _start ()
Now of course, you need our syslog config.
cat /etc/rsyslog.conf
$PreserveFQDN on
$ModLoad imuxsock
$ModLoad imklog
$ModLoad immark
$umask 0000
$CreateDirs on
$DirOwner root
$DirGroup root
$DirCreateMode 0755
$EscapeControlC
$FileOwner root
$FileGroup root
$FileCreateMode 0644
$MarkMessagePeriod 600
$IncludeConfig /etc/rsyslog.
antarus@
$WorkDirectory /var/spool/rsyslog
$ActionQueueFil
$ActionQueueChe
# A 100000µs delay effects a rate limit of 10 messages per second.
$ActionQueueDeq
$ActionQueueM
$ActionQueueSav
$ActionQueueType LinkedList
# Do not suspend the retry on machines assumed to be connected
# (I.e., stick to once per second.)
$ActionResumeRe
$ActionResumeIn
#*.* @@REDACTED_
I will attach the busted spool files as well.
root@antarus-
Description: Ubuntu 12.04.2 LTS
Release: 12.04
root@antarus-
rsyslog:
Installed: 5.8.6-1ubuntu8.5
Candidate: 5.8.6-1ubuntu8.5
I expect rsyslog to not crash, and instead detect bad spool files and tell me.
Instead it crashed.
tags: | added: precise |
description: | updated |
description: | updated |
description: | updated |
tags: |
added: verification-done removed: verification-needed |
This is the corrupted spool. I recommend using a VM, or otherwise backing up /var/spool/rsyslog.
-A