Hi Mario, Thanks for the information and the report. I found the problem and it is actually in one of the error messages incorrectly formatted. It will be fixed in the next version.
Btw, you should probably use the latest version: http://www.ossec.net/files/ossec-hids-0.8-3.tar.gz Thanks, -- Daniel B. Cid dcid @ ( at ) ossec.net On 6/22/06, Mário Roberto Ginglass <[EMAIL PROTECTED]> wrote: > > Daniel, > > I instaled version 0.8. > [EMAIL PROTECTED] md5sum /usr/src/ossec-hids-0.8.tar.gz > 22a98f9885c1a79759688c35c6805aa9 > /usr/src/ossec-hids-0.8.tar.gz > > It is running on: > Linux xpto.com.br 2.6.15-1.1831_FC4smp #1 SMP Tue Feb 7 13:51:52 EST 2006 > x86_64 x86_64 x86_64 GNU/Linux > > [EMAIL PROTECTED] ../bin/ossec-logcollector > 2006/06/22 14:47:03 Falha de segmentação > > strace: > (...) > open("/var/ossec/logs/ossec.log", > O_WRONLY|O_APPEND|O_CREAT, 0666) = 3 > fstat(3, {st_mode=S_IFREG|0664, st_size=22382, ...}) = 0 > mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = > 0x2aaaaaaac000 > fstat(3, {st_mode=S_IFREG|0664, st_size=22382, ...}) = 0 > lseek(3, 22382, SEEK_SET) = 22382 > write(3, "2006/06/22 14:47:41 ossec-logcol"..., 97) = 97 > close(3) = 0 > munmap(0x2aaaaaaac000, 4096) = 0 > write(2, "2006/06/22 14:47:41 ", 202006/06/22 14:47:41 ) = 20 > --- SIGSEGV (Segmentation fault) @ 0 (0) --- > +++ killed by SIGSEGV +++ > > There is no other message at ossec.log. Just, as I told before: > 2006/06/22 14:47:41 ossec-logcollector(1236): Maximum number of elements > reached for: localfile. > > Regards, > Mario > > > > On 6/22/06, Daniel Cid <[EMAIL PROTECTED]> wrote: > > Hey, > > > > This is strange.. The maximum number of allowed files by default is 16 > > and when it is reached, no segmentation fault should occur (because we > > check for it and exit). Maybe there is another problem there... > > > > -Which version of ossec are you using? > > -If you add the other files back and execute > :/var/ossec/bin/ossec-logcollector > > does it segfaults? > > -Is there any other error in the logs? > > > > Thanks, > > > > -- > > Daniel B. Cid > > dcid @ ( at ) ossec.net > > > > On 6/22/06, ginglass <[EMAIL PROTECTED] > wrote: > > > > > > Just a tip, OSSEC Segfault if I have more then 13 localfiles. > > > I could accept this limit but I (as a newbie) expect a better error > > > message (just like in ossec.log). > > > [EMAIL PROTECTED] ~]# /etc/init.d/ossec start > > > Starting OSSEC: 2006/06/22 12:38:01 /var/ossec/bin/ossec-control: line > > > 52: 19525 Falha de segmentação ${DIR}/bin/${i} -t > > > [FALHOU] > > > > > > It is better in logfile ossec.log: > > > 2006/06/22 12:32:01 ossec-logcollector(1236): Maximum number of > > > elements reached for: localfile > > > > > > Tnks, > > > Mario > > > > > > > > > > > > > > > > --~--~---------~--~----~------------~-------~--~----~ -~----------~----~----~----~------~----~------~--~---
