Re: [ossec-list] Problems with ossec-maild

2012-03-27 Thread dan (ddp)
What's your mail configuration in the manager's ossec.conf?

I wish ossec was compiled with -ggdb by default. It might make the gdb
information a bit easier to follow.

On Thu, Mar 22, 2012 at 1:47 PM, MDACC-Luckie luckief...@gmail.com wrote:
 I increased the number of agents my installation was capable of
 supporting, reinstalled and then copied my saved ossec.conf file and
 internal_options.conf into the ossec/etc directory and restarted
 ossec.  My ossec-maild daemon starts, runs for a few seconds and then
 dies.

 I ran the following based on a previous email thread I saw and have
 attached the results.  Please let me know if anyone has ideas on why
 it is happening:

 [root@dcprpoemprddb1 logs]# gdb /opt/ossec/bin/ossec-maild
 GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-23.el5_5.2)
 Copyright (C) 2009 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/
 gpl.html
 This is free software: you are free to change and redistribute it.
 There is NO WARRANTY, to the extent permitted by law.  Type show
 copying
 and show warranty for details.
 This GDB was configured as x86_64-redhat-linux-gnu.
 For bug reporting instructions, please see:
 http://www.gnu.org/software/gdb/bugs/...
 Reading symbols from /opt/ossec/bin/ossec-maild...done.
 (gdb) set follow-fork-mode child
 (gdb) run
 Starting program: /opt/ossec/bin/ossec-maild
 [New process 2615]
 [New process 2616]

 Program received signal SIGSEGV, Segmentation fault.
 [Switching to process 2616]
 0x00387c879b60 in strlen () from /lib64/libc.so.6
 (gdb) bt
 #0  0x00387c879b60 in strlen () from /lib64/libc.so.6
 #1  0x00387c846cb9 in vfprintf () from /lib64/libc.so.6
 #2  0x00387c8699da in vsnprintf () from /lib64/libc.so.6
 #3  0x00387c84d5e3 in snprintf () from /lib64/libc.so.6
 #4  0x00402d66 in OS_RecvMailQ (fileq=0x635640,
 p=0x387cb56cc0, Mail=0x7fffe870, msg_sms=0x7fffe7e0)
    at os_maild_client.c:96
 #5  0x00402848 in OS_Run (mail=0x7fffe870) at maild.c:381
 #6  0x004023d0 in main (argc=1, argv=0x7fffe9f8) at
 maild.c:171
 (gdb)


Re: [ossec-list] Problems with ossec-maild

2012-03-26 Thread Andreas Piesk
On 22.03.2012 18:47, MDACC-Luckie wrote:
 I ran the following based on a previous email thread I saw and have
 attached the results.  Please let me know if anyone has ideas on why
 it is happening:

not quite sure. do you know how to reproduce it? i tried but wasn't able to.

please set a breakpoint at
os_maild_client.c:94:

 snprintf(mail-subject, SUBJECT_SIZE -1, MAIL_SUBJECT,

and print out the contents of mail and al_data.

regards,
-ap