ulogd hang at fclose sometimes

[hyr666]

ulgod2.0.4+ubuntu12.04 inside amazon datacenter
on production system, ulogd keep write traffic into pcap file through pcap plugin.
and log rotate will transfer the pcap file to other place.
but it will hang after several days.

when the problem happened, the bt trace is following:
(gdb) bt
#0 0x00007fb0875055bb in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007fb087480558 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#2 0x00007fb08747e95c in _IO_un_link () from /lib/x86_64-linux-gnu/libc.so.6
#3 0x00007fb087471ad5 in fclose () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x00007fb0867eada8 in signal_pcap (upi=0x7fb08995e830, signal=<optimized out>) at ulogd_output_PCAP.c:262
#5 signal_pcap (upi=0x7fb08995e830, signal=<optimized out>) at ulogd_output_PCAP.c:255
#6 0x00007fb087e0c138 in deliver_signal_pluginstances (signal=1) at ulogd.c:1183
#7 <signal handler called>
#8 0x00007fb087472f91 in fwrite () from /lib/x86_64-linux-gnu/libc.so.6
#9 0x00007fb0867eac8f in interp_pcap (upi=0x7fb08995e830) at ulogd_output_PCAP.c:184
#10 0x00007fb087e0df0b in ulogd_propagate_results (pi=0x7fb08995bb50) at ulogd.c:518
#11 0x00007fb087201066 in interp_packet (ldata=0x7fff80e59c30, pf_family=<optimized out>, upi=0x7fb08995bb50) at ulogd_inppkt_NFLOG.c:400
#12 msg_cb (data=0x7fb08995bb50, nfa=0x7fff80e59c30, nfmsg=0x7fb087cfd0d4, gh=<optimized out>) at ulogd_inppkt_NFLOG.c:483
#13 msg_cb (gh=<optimized out>, nfmsg=0x7fb087cfd0d4, nfa=0x7fff80e59c30, data=0x7fb08995bb50) at ulogd_inppkt_NFLOG.c:469
#14 0x00007fb086ffc145 in ?? () from /usr/lib/libnetfilter_log.so.1
#15 0x00007fb086df6036 in ?? () from /usr/lib/libnfnetlink.so.0
#16 0x00007fb086df60ba in nfnl_handle_packet () from /usr/lib/libnfnetlink.so.0
#17 0x00007fb087200978 in nful_read_cb (param=0x7fb08995bb50, fd=<optimized out>, what=<optimized out>) at ulogd_inppkt_NFLOG.c:463
#18 nful_read_cb (fd=<optimized out>, what=<optimized out>, param=0x7fb08995bb50) at ulogd_inppkt_NFLOG.c:422
#19 0x00007fb087e0e486 in ulogd_select_main (tv=<optimized out>) at select.c:105
#20 0x00007fb087e0bdc8 in ulogd_main_loop () at ulogd.c:934
#21 main (argc=<optimized out>, argv=<optimized out>) at ulogd.c:1477

[Hironobu Ishii (ishii-hironobu)]

Root cause is calling fclose() in signal handler context.
Functions like fopen(), fclose(), malloc(), free(), etc are not allowed to call in signal handler context.

I believe following upstream commit will solve your issue.

http://git.netfilter.org/ulogd2/commit/?id=1f70d2ba45e2b067777d5386b8d3f2e09be9118b

In my environment, I applied this patch to ulogd-2.0.4 and it works well.
I cloud applied upstream patch cleanly to ulogd-2.0.4.