If there's a eventlog entry bigger than the default BUFFER_SIZE then the logwatch enters an endless loop.
If the buffer isn't big enough then there's a realloc with size "bytesNeeded" but the buffersize stays "BUFFER_SIZE" in stead of bufferSize.
diff:
--- C:/Temp/eventlog.cpp-revBASE.svn001.tmp.cpp Tue Aug 14 19:44:38 2012
+++ D:/Source/netxms/trunk/src/agent/subagents/logwatch/eventlog.cpp Wed Feb 27 19:56:50 2013
@@ -341,7 +341,7 @@
{
retry_read:
success = ReadEventLog(hLog, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ, 0,
- buffer, BUFFER_SIZE, &bytes, &bytesNeeded);
+ buffer, bufferSize, &bytes, &bytesNeeded);
error = GetLastError();
if (!success && (error == ERROR_INSUFFICIENT_BUFFER))
{
Hi!
Thanks for the fix, just committed it into trunk.
Best regards,
Victor