Segmentation fault NXAGEND

[ss95089]

Hello.

I report about "Segmentation fault" Error on NXAGEND.
nxagend is down when logwatch subagent detect matching string in file.

debug log message

LinuxServer:/etc/nxagentd# /opt/netxms/bin/nxagentd -D 9 -f -c /etc/nxagentd.conf
[12-Nov-2010 22:39:54] Debug level set to 9
[12-Nov-2010 22:39:54] Subagent API initialized
[12-Nov-2010 22:39:55] Linux: using /sys/block to distinguish devices from partitions
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram0 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram1 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram2 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram3 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram4 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram5 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram6 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram7 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda1 isRealDevice=0)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda2 isRealDevice=0)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda3 isRealDevice=0)
[12-Nov-2010 22:39:55] Unable to parse /proc/drbd, DRBD data collector will not start
[12-Nov-2010 22:39:55] Subagent "/opt/netxms/lib/libnsm_linux.so" loaded successfully
[12-Nov-2010 22:39:55] LogWatch: registered parser for file /var/log/auth.log, trace level set to 0
[12-Nov-2010 22:39:55] LogParser: parser thread for file "/var/log/auth.log" started
[12-Nov-2010 22:39:55] LogParser: file "/var/log/auth.log" (pattern "/var/log/auth.log") successfully opened
[12-Nov-2010 22:39:55] Subagent "/opt/netxms/lib/libnsm_logwatch.so" loaded successfully
[12-Nov-2010 22:39:56] Trying to bind on 0.0.0.0:4700
[12-Nov-2010 22:39:56] Listening on socket 0.0.0.0:4700
[12-Nov-2010 22:39:57] NetXMS Agent started
Agent running. Press Ctrl+C to shutdown.
[12-Nov-2010 22:40:05] LogParser: new data avialable in file "/var/log/auth.log"
[12-Nov-2010 22:40:05] SendTrap(): event_code=100000, num_args=1, arg[0]="Nov 12 22:40:03 LinuxServer sshd[2945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.2.105  user=root" arg[1]="(null)" arg[2]="(null)"
Segmentation fault

logwatch config file with problem

<parser>
<file>/var/log/auth.log</file>
<rules>
<rule break="1"><match>.*Failed password.*</match></rule>
<rule><match>(.*ABORT.*|.*Abort.*|.*abort.*)</match><event params="1">100000</event></rule>
<rule><match>(.*ALERT.*|.*Alert.*|.*alert.*)</match><event params="1">100000</event></rule>
<rule><match>(.*CRIT.*|.*Crit.*|.*crit.*)</match><event params="1">100000</event></rule>
<rule><match>(.* BAD .*|.*Bad .*|.* bad .*)</match><event params="1">100000</event></rule>
<rule><match>(.* DOWN.*|.*Down.*|.* down.*)</match><event params="1">100000</event></rule>
<rule><match>(.*EMERG.*|.*Emerg.*|.*emerg.*)</match><event params="1">100000</event></rule>
<rule><match>(.* ERR.*|.*Err.*|.* err.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAIL.*|.*Fail.*|.* fail.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAULT.*|.*Fault.*|.* fault.*)</match><event params="1">100000</event></rule>
<rule><match>(.* HALT.*|.*Halt.*|.* halt.*)</match><event params="1">100000</event></rule>
<rule><match>(.*PANIC.*|.*Panic.*|.*panic.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WRONG.*|.*Wrong.*|.*wrong.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WARN.*|.*Warn.*|.*warn.*)</match><event params="1">100000</event></rule>
</rules>
</parser>

logwatch config file with no problem

<parser>
<file>/var/log/auth.log</file>
<rules>
<rule break="1"><match>.*Failed password.*</match><event></event></rule>
<rule><match>(.*ABORT.*|.*Abort.*|.*abort.*)</match><event params="1">100000</event></rule>
<rule><match>(.*ALERT.*|.*Alert.*|.*alert.*)</match><event params="1">100000</event></rule>
<rule><match>(.*CRIT.*|.*Crit.*|.*crit.*)</match><event params="1">100000</event></rule>
<rule><match>(.* BAD .*|.*Bad .*|.* bad .*)</match><event params="1">100000</event></rule>
<rule><match>(.* DOWN.*|.*Down.*|.* down.*)</match><event params="1">100000</event></rule>
<rule><match>(.*EMERG.*|.*Emerg.*|.*emerg.*)</match><event params="1">100000</event></rule>
<rule><match>(.* ERR.*|.*Err.*|.* err.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAIL.*|.*Fail.*|.* fail.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAULT.*|.*Fault.*|.* fault.*)</match><event params="1">100000</event></rule>
<rule><match>(.* HALT.*|.*Halt.*|.* halt.*)</match><event params="1">100000</event></rule>
<rule><match>(.*PANIC.*|.*Panic.*|.*panic.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WRONG.*|.*Wrong.*|.*wrong.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WARN.*|.*Warn.*|.*warn.*)</match><event params="1">100000</event></rule>
</rules>
</parser>

My environment

NetXMS 1.0.7
OS:Linux LinuxServer 2.6.29 #1 Thu Sep 16 12:24:59 JST 2010 ppc GNU/Linux

[victor]

Hi!

Unfortunately I cannot reproduce this on my system. Could you please run nxagentd under gdb and send me a backtrace after crash?

To run agent under gdb:

1. Run command
   gdb /opt/netxms/bin/nxagentd

You will get gdb prompt:
(gdb)

Type command:
run -f

Agent will run in foreground. After crash, gdb prompt will appear:
(gdb)

Type command
bt

and send it's output to me.

Best regards,
Victor

[ss95089]

Hi! Victor-san.

Thank you for reply.
I ran nxagentd under gdb.I attach a backtrace file after crash.
Could you check the file.

---

command.log

[alk]

Thank you for backtrace, I've found problem.

Fix will be released in upcoming 1.0.8, meanwhile you can apply attached patch.

Best regards,
Alex.

---

parser.diff

[ss95089]

Hi! Alex-san.

I applied patch. And I confirmed the problem had been solved.
Thank you for your support.

Sincerely.
Shin