Hi Sergej, Thanks for the report. I try to fix that. - Peter
On 21/08/14 15:35, Sergej Lang wrote: > Hi all, > > i probably have found a bug in nfdump 1.6.12 with nsel enabled on > Solaris 11/Sparc. My Netflow exporter is ASA 9.2 > > The binary was built with 'oracle provided' gcc4.5.2 and > '--enable-nsel'. nfcapd runs fine, but 'nfdump -r' cores with bus error > after few lines of output. (nfdump -v, nfdump -x nsel enabled will > successfully verify gathered data file ). > > Binary compiled without nsel extension will consume all input files > without error. > > * Versions used: > > `which gcc` --version > gcc (GCC) 4.5.2 (from Oracle Solaris 11 repository) > > `which gmake` --version > GNU Make 3.82 > > `which as` -V > /usr/bin/as: Sun Compiler Common 12 SunOS_sparc s11_1sru13_04 10/22/2013 > > /var/tmp/nfcapd.201408211345 , gathered with nfcapd with nsel extension. > > > * Compile without O2 optimization and with enable-nsel > > /var/tmp/nfdump-1.6.12 > # -O2 optimisation removed, cast-align warnings added > export CFLAGS="-g -Wall -Wcast-align -Wstrict-prototypes > -Wmissing-prototypes -Wmissing-declarations -Wmissing-noreturn > -fno-strict-aliasing -DNSEL" > ./configure --enable-nsel > gmake clean; gmake > > > * Gathered data with nfcapd `./bin/nfcapd -w -t 300 -D -T all -n > asa-fw,10.0.19.131,/var/nflogdata -p 9995 -b 10.0.14.17 -S 1` > > > * Test against previously gathered data > ./bin/nfdump -r /var/tmp/nfcapd.201408211345 > dumps with bus error > > truss ./bin/nfdump -r /var/tmp/nfcapd.201408211345 2>&1|tail -5 > close(4) = 0 > Incurred fault #5, FLTACCESS %pc = 0x000170F4 > siginfo: SIGBUS BUS_ADRALN addr=0x0012475C > Received signal #10, SIGBUS [default] > siginfo: SIGBUS BUS_ADRALN addr=0x0012475C > > > > gdb --eval-command=run --args ./bin/nfdump -r /var/tmp/nfcapd.201408211345 > yields: > Some successfully parsed and formatted output lines, then: > > Program received signal SIGSEGV, Segmentation fault. > 0x000170f4 in ExpandRecord_v2 (input_record=0x124710, > extension_info=0x112498, exporter_info=0x110cd0, > output_record=0x1124a8) at nffile_inline.c:363 > 363 output_record->event_time = > tpl->event_time; > > The 'SIGSEGV' message might be misleading, see truss output above for > FLTACCESS fault suggesting a misaligned memory access. > fault.h > #define FLTACCESS 5 /* Memory access (e.g., alignment) */ > > > I may provide an example of collected data if needed. > Do you have an idea how I can fix this problem? > > thanks, > Sergej > > ------------------------------------------------------------------------------ > Slashdot TV. > Video for Nerds. Stuff that matters. > http://tv.slashdot.org/ > _______________________________________________ > Nfdump-discuss mailing list > Nfdump-discuss@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/nfdump-discuss > ------------------------------------------------------------------------------ Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk _______________________________________________ Nfdump-discuss mailing list Nfdump-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfdump-discuss