NetXMS Support Forum

Hello.

I report about "Segmentation fault" Error on NXAGEND.
nxagend is down when logwatch subagent detect matching string in file.

debug log message

QuoteLinuxServer:/etc/nxagentd# /opt/netxms/bin/nxagentd -D 9 -f -c /etc/nxagentd.conf
[12-Nov-2010 22:39:54] Debug level set to 9
[12-Nov-2010 22:39:54] Subagent API initialized
[12-Nov-2010 22:39:55] Linux: using /sys/block to distinguish devices from partitions
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram0 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram1 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram2 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram3 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram4 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram5 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram6 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram7 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda1 isRealDevice=0)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda2 isRealDevice=0)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda3 isRealDevice=0)
[12-Nov-2010 22:39:55] Unable to parse /proc/drbd, DRBD data collector will not start
[12-Nov-2010 22:39:55] Subagent "/opt/netxms/lib/libnsm_linux.so" loaded successfully
[12-Nov-2010 22:39:55] LogWatch: registered parser for file /var/log/auth.log, trace level set to 0
[12-Nov-2010 22:39:55] LogParser: parser thread for file "/var/log/auth.log" started
[12-Nov-2010 22:39:55] LogParser: file "/var/log/auth.log" (pattern "/var/log/auth.log") successfully opened
[12-Nov-2010 22:39:55] Subagent "/opt/netxms/lib/libnsm_logwatch.so" loaded successfully
[12-Nov-2010 22:39:56] Trying to bind on 0.0.0.0:4700
[12-Nov-2010 22:39:56] Listening on socket 0.0.0.0:4700
[12-Nov-2010 22:39:57] NetXMS Agent started
Agent running. Press Ctrl+C to shutdown.
[12-Nov-2010 22:40:05] LogParser: new data avialable in file "/var/log/auth.log"
[12-Nov-2010 22:40:05] SendTrap(): event_code=100000, num_args=1, arg[0]="Nov 12 22:40:03 LinuxServer sshd[2945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.2.105  user=root" arg[1]="(null)" arg[2]="(null)"
Segmentation fault

logwatch config file with problem

Quote
<parser>
<file>/var/log/auth.log</file>
<rules>
<rule break="1"><match>.*Failed password.*</match></rule>
<rule><match>(.*ABORT.*|.*Abort.*|.*abort.*)</match><event params="1">100000</event></rule>
<rule><match>(.*ALERT.*|.*Alert.*|.*alert.*)</match><event params="1">100000</event></rule>
<rule><match>(.*CRIT.*|.*Crit.*|.*crit.*)</match><event params="1">100000</event></rule>
<rule><match>(.* BAD .*|.*Bad .*|.* bad .*)</match><event params="1">100000</event></rule>
<rule><match>(.* DOWN.*|.*Down.*|.* down.*)</match><event params="1">100000</event></rule>
<rule><match>(.*EMERG.*|.*Emerg.*|.*emerg.*)</match><event params="1">100000</event></rule>
<rule><match>(.* ERR.*|.*Err.*|.* err.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAIL.*|.*Fail.*|.* fail.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAULT.*|.*Fault.*|.* fault.*)</match><event params="1">100000</event></rule>
<rule><match>(.* HALT.*|.*Halt.*|.* halt.*)</match><event params="1">100000</event></rule>
<rule><match>(.*PANIC.*|.*Panic.*|.*panic.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WRONG.*|.*Wrong.*|.*wrong.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WARN.*|.*Warn.*|.*warn.*)</match><event params="1">100000</event></rule>
</rules>
</parser>

logwatch config file with no problem

Quote
<parser>
<file>/var/log/auth.log</file>
<rules>
<rule break="1"><match>.*Failed password.*</match><event></event></rule>
<rule><match>(.*ABORT.*|.*Abort.*|.*abort.*)</match><event params="1">100000</event></rule>
<rule><match>(.*ALERT.*|.*Alert.*|.*alert.*)</match><event params="1">100000</event></rule>
<rule><match>(.*CRIT.*|.*Crit.*|.*crit.*)</match><event params="1">100000</event></rule>
<rule><match>(.* BAD .*|.*Bad .*|.* bad .*)</match><event params="1">100000</event></rule>
<rule><match>(.* DOWN.*|.*Down.*|.* down.*)</match><event params="1">100000</event></rule>
<rule><match>(.*EMERG.*|.*Emerg.*|.*emerg.*)</match><event params="1">100000</event></rule>
<rule><match>(.* ERR.*|.*Err.*|.* err.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAIL.*|.*Fail.*|.* fail.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAULT.*|.*Fault.*|.* fault.*)</match><event params="1">100000</event></rule>
<rule><match>(.* HALT.*|.*Halt.*|.* halt.*)</match><event params="1">100000</event></rule>
<rule><match>(.*PANIC.*|.*Panic.*|.*panic.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WRONG.*|.*Wrong.*|.*wrong.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WARN.*|.*Warn.*|.*warn.*)</match><event params="1">100000</event></rule>
</rules>
</parser>

My environment

Quote
NetXMS 1.0.7
OS:Linux LinuxServer 2.6.29 #1 Thu Sep 16 12:24:59 JST 2010 ppc GNU/Linux

Hi!

Unfortunately I cannot reproduce this on my system. Could you please run nxagentd under gdb and send me a backtrace after crash?

To run agent under gdb:

1. Run command
gdb /opt/netxms/bin/nxagentd

You will get gdb prompt:
(gdb)

Type command:
run -f

Agent will run in foreground. After crash, gdb prompt will appear:
(gdb)

Type command
bt

and send it's output to me.

Best regards,
Victor

Hi! Victor-san.

Thank you for reply.
I ran nxagentd under gdb.I attach a backtrace file after crash.
Could you check the file.

Thank you for backtrace, I've found problem.

Fix will be released in upcoming 1.0.8, meanwhile you can apply attached patch.

Best regards,
Alex.

Hi! Alex-san.

I applied patch. And I confirmed the problem had been solved.
Thank you for your support.

Sincerely.
Shin