Daniel,
I instaled version 0.8.
[EMAIL PROTECTED] md5sum /usr/src/ossec-hids-0.8.tar.gz
22a98f9885c1a79759688c35c6805aa9 /usr/src/ossec-hids-0.8.tar.gz
22a98f9885c1a79759688c35c6805aa9 /usr/src/ossec-hids-0.8.tar.gz
It is running on:
Linux xpto.com.br 2.6.15-1.1831_FC4smp #1 SMP Tue Feb 7 13:51:52 EST 2006 x86_64 x86_64 x86_64 GNU/Linux
[EMAIL PROTECTED] ../bin/ossec-logcollector
2006/06/22 14:47:03 Falha de segmentação
2006/06/22 14:47:03 Falha de segmentação
strace:
(...)
open("/var/ossec/logs/ossec.log", O_WRONLY|O_APPEND|O_CREAT, 0666) = 3
fstat(3, {st_mode=S_IFREG|0664, st_size=22382, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaaaac000
fstat(3, {st_mode=S_IFREG|0664, st_size=22382, ...}) = 0
lseek(3, 22382, SEEK_SET) = 22382
write(3, "2006/06/22 14:47:41 ossec-logcol"..., 97) = 97
close(3) = 0
munmap(0x2aaaaaaac000, 4096) = 0
write(2, "2006/06/22 14:47:41 ", 202006/06/22 14:47:41 ) = 20
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
fstat(3, {st_mode=S_IFREG|0664, st_size=22382, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2aaaaaaac000
fstat(3, {st_mode=S_IFREG|0664, st_size=22382, ...}) = 0
lseek(3, 22382, SEEK_SET) = 22382
write(3, "2006/06/22 14:47:41 ossec-logcol"..., 97) = 97
close(3) = 0
munmap(0x2aaaaaaac000, 4096) = 0
write(2, "2006/06/22 14:47:41 ", 202006/06/22 14:47:41 ) = 20
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
There is no other message at ossec.log. Just, as I told before:
2006/06/22 14:47:41 ossec-logcollector(1236): Maximum number of elements reached for: localfile.
Regards,
Mario
On 6/22/06, Daniel Cid <[EMAIL PROTECTED]> wrote:
Hey,
This is strange.. The maximum number of allowed files by default is 16
and when it is reached, no segmentation fault should occur (because we
check for it and exit). Maybe there is another problem there...
-Which version of ossec are you using?
-If you add the other files back and execute :/var/ossec/bin/ossec-logcollector
does it segfaults?
-Is there any other error in the logs?
Thanks,
--
Daniel B. Cid
dcid @ ( at ) ossec.net
On 6/22/06, ginglass <[EMAIL PROTECTED] > wrote:
>
> Just a tip, OSSEC Segfault if I have more then 13 localfiles.
> I could accept this limit but I (as a newbie) expect a better error
> message (just like in ossec.log).
> [EMAIL PROTECTED] ~]# /etc/init.d/ossec start
> Starting OSSEC: 2006/06/22 12:38:01 /var/ossec/bin/ossec-control: line
> 52: 19525 Falha de segmentação ${DIR}/bin/${i} -t
> [FALHOU]
>
> It is better in logfile ossec.log:
> 2006/06/22 12:32:01 ossec-logcollector(1236): Maximum number of
> elements reached for: localfile
>
> Tnks,
> Mario
>
>
>
--~--~---------~--~----~------------~-------~--~----~
-~----------~----~----~----~------~----~------~--~---
- [ossec-list] OSSEC-CONTROL Segfault message ginglass
- [ossec-list] Re: OSSEC-CONTROL Segfault messa... Daniel Cid
- [ossec-list] Re: OSSEC-CONTROL Segfault m... Mário Roberto Ginglass
- [ossec-list] Re: OSSEC-CONTROL Segfau... Daniel Cid
- [ossec-list] Re: OSSEC-CONTROL Se... Mário Roberto Ginglass
