[
https://bro-tracker.atlassian.net/browse/BIT-1239?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17902#comment-17902
]
Robin Sommer commented on BIT-1239:
-----------------------------------
2.3, so yeah that's a possible explanation, though hard to say.
> Crash because StringVal ref_cnt greater than INT_MAX
> ----------------------------------------------------
>
> Key: BIT-1239
> URL: https://bro-tracker.atlassian.net/browse/BIT-1239
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Affects Versions: git/master, 2.3
> Reporter: Johanna Amann
> Fix For: 2.4
>
>
> Several of the workers of our cluster recently crashed because of the compare
> in line 212 of Obj.h (function Ref, where o->ref_cnt is compared to INT_MAX).
> Closer examination of the stack traces of a few systems reveals that it was
> the StringVal base_type which was ref'd more than INT_MAX times.
> In the last few times, a user in our network performed tests generating a
> massive amount of connections, including test with just syn-packets. It is
> therefore probably a good guess that somewhere in the connection handling, a
> ref on a base_type is called without an corresponding unref.
> Relevant part of a backtrace:
> {code}
> #0 0x000000080194cfcc in kill () from /lib/libc.so.7
> #1 0x000000080194bdcb in abort () from /lib/libc.so.7
> #2 0x00000000004ca550 in Reporter::InternalError (this=)
> at /home/robin/bro/master/src/Reporter.cc:137
> #3 0x00000000004d1d79 in bad_ref (type=)
> at /home/robin/bro/master/src/Obj.cc:253
> #4 0x00000000005273cd in base_type (tag=) at Obj.h:208
> #5 0x0000000000538d8b in StringVal (this=0x87abca240, length=66,
> s=0x85b5e3290 "[...]") at Val.h:369
> {code}
> stderr.log:
> {code}
> 1406688636.803846 processing suspended
> 1406688636.803849 processing continued
> 1406688642.801786 Failed to open GeoIP Cityv6 database:
> /usr/local/share/GeoIP/GeoIPCityv6.dat
> 1406688642.801786 Failed to open GeoIPv6 Country database:
> /usr/local/share/GeoIP/GeoIPv6.dat
> 1409680506.073977 internal error: bad reference count [1]
> /xa/bro/share/broctl/scripts/run-bro: line 85: 98029 Abort trap: 6
> (core dumped) nohup $mybro "$@"
> {code}
--
This message was sent by Atlassian JIRA
(v6.4-OD-04-006#64001)
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
