Hello.
I report about "Segmentation fault" Error on NXAGEND.
nxagend is down when logwatch subagent detect matching string in file.
debug log message
LinuxServer:/etc/nxagentd# /opt/netxms/bin/nxagentd -D 9 -f -c /etc/nxagentd.conf
[12-Nov-2010 22:39:54] Debug level set to 9
[12-Nov-2010 22:39:54] Subagent API initialized
[12-Nov-2010 22:39:55] Linux: using /sys/block to distinguish devices from partitions
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram0 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram1 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram2 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram3 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram4 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram5 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram6 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=ram7 isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda isRealDevice=1)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda1 isRealDevice=0)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda2 isRealDevice=0)
[12-Nov-2010 22:39:55] ParseIoStat(): new device added (name=sda3 isRealDevice=0)
[12-Nov-2010 22:39:55] Unable to parse /proc/drbd, DRBD data collector will not start
[12-Nov-2010 22:39:55] Subagent "/opt/netxms/lib/libnsm_linux.so" loaded successfully
[12-Nov-2010 22:39:55] LogWatch: registered parser for file /var/log/auth.log, trace level set to 0
[12-Nov-2010 22:39:55] LogParser: parser thread for file "/var/log/auth.log" started
[12-Nov-2010 22:39:55] LogParser: file "/var/log/auth.log" (pattern "/var/log/auth.log") successfully opened
[12-Nov-2010 22:39:55] Subagent "/opt/netxms/lib/libnsm_logwatch.so" loaded successfully
[12-Nov-2010 22:39:56] Trying to bind on 0.0.0.0:4700
[12-Nov-2010 22:39:56] Listening on socket 0.0.0.0:4700
[12-Nov-2010 22:39:57] NetXMS Agent started
Agent running. Press Ctrl+C to shutdown.
[12-Nov-2010 22:40:05] LogParser: new data avialable in file "/var/log/auth.log"
[12-Nov-2010 22:40:05] SendTrap(): event_code=100000, num_args=1, arg[0]="Nov 12 22:40:03 LinuxServer sshd[2945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.2.105 user=root" arg[1]="(null)" arg[2]="(null)"
Segmentation fault
logwatch config file with problem
<parser>
<file>/var/log/auth.log</file>
<rules>
<rule break="1"><match>.*Failed password.*</match></rule>
<rule><match>(.*ABORT.*|.*Abort.*|.*abort.*)</match><event params="1">100000</event></rule>
<rule><match>(.*ALERT.*|.*Alert.*|.*alert.*)</match><event params="1">100000</event></rule>
<rule><match>(.*CRIT.*|.*Crit.*|.*crit.*)</match><event params="1">100000</event></rule>
<rule><match>(.* BAD .*|.*Bad .*|.* bad .*)</match><event params="1">100000</event></rule>
<rule><match>(.* DOWN.*|.*Down.*|.* down.*)</match><event params="1">100000</event></rule>
<rule><match>(.*EMERG.*|.*Emerg.*|.*emerg.*)</match><event params="1">100000</event></rule>
<rule><match>(.* ERR.*|.*Err.*|.* err.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAIL.*|.*Fail.*|.* fail.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAULT.*|.*Fault.*|.* fault.*)</match><event params="1">100000</event></rule>
<rule><match>(.* HALT.*|.*Halt.*|.* halt.*)</match><event params="1">100000</event></rule>
<rule><match>(.*PANIC.*|.*Panic.*|.*panic.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WRONG.*|.*Wrong.*|.*wrong.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WARN.*|.*Warn.*|.*warn.*)</match><event params="1">100000</event></rule>
</rules>
</parser>
logwatch config file with no problem
<parser>
<file>/var/log/auth.log</file>
<rules>
<rule break="1"><match>.*Failed password.*</match><event></event></rule>
<rule><match>(.*ABORT.*|.*Abort.*|.*abort.*)</match><event params="1">100000</event></rule>
<rule><match>(.*ALERT.*|.*Alert.*|.*alert.*)</match><event params="1">100000</event></rule>
<rule><match>(.*CRIT.*|.*Crit.*|.*crit.*)</match><event params="1">100000</event></rule>
<rule><match>(.* BAD .*|.*Bad .*|.* bad .*)</match><event params="1">100000</event></rule>
<rule><match>(.* DOWN.*|.*Down.*|.* down.*)</match><event params="1">100000</event></rule>
<rule><match>(.*EMERG.*|.*Emerg.*|.*emerg.*)</match><event params="1">100000</event></rule>
<rule><match>(.* ERR.*|.*Err.*|.* err.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAIL.*|.*Fail.*|.* fail.*)</match><event params="1">100000</event></rule>
<rule><match>(.* FAULT.*|.*Fault.*|.* fault.*)</match><event params="1">100000</event></rule>
<rule><match>(.* HALT.*|.*Halt.*|.* halt.*)</match><event params="1">100000</event></rule>
<rule><match>(.*PANIC.*|.*Panic.*|.*panic.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WRONG.*|.*Wrong.*|.*wrong.*)</match><event params="1">100000</event></rule>
<rule><match>(.*WARN.*|.*Warn.*|.*warn.*)</match><event params="1">100000</event></rule>
</rules>
</parser>
My environment
NetXMS 1.0.7
OS:Linux LinuxServer 2.6.29 #1 Thu Sep 16 12:24:59 JST 2010 ppc GNU/Linux