Thanks for this, Roch.
My "truss" seems to have shown up the same problem...
29231: poll(0xFFBFE210, 0, 5000) = 0
29231: read(5, 0x000A2ABC, 8192) = 0
29231: poll(0xFFBFE210, 0, 5000) (sleeping...)
29231: poll(0xFFBFE210, 0, 5000) = 0
29231: time() = 1202256022
29231: read(5, 0x000A2ABC, 8192) = 0
29231: llseek(5, 0, SEEK_CUR) = 84763
29231: close(5) = 0
29231: open64("/logs/alerts/2008/Feb/ossec-alerts-06.log", O_RDONLY) Err#2
ENOENT
29231: Incurred fault #6, FLTBOUNDS %pc = 0xFF1922E4
29231: siginfo: SIGSEGV SEGV_MAPERR addr=0x0000000C
29231: Received signal #11, SIGSEGV [default]
29231: siginfo: SIGSEGV SEGV_MAPERR addr=0x0000000C
...so I expect upgrading to a recent snapshot will fix the problem.
Question is, though, which snapshot?
ossec-hids-071129.tar.gz 29-Nov-2007 23:04 585K
ossec-hids-071206.tar.gz 07-Dec-2007 00:59 585K
ossec-hids-071211.tar.gz 11-Dec-2007 21:41 585K
ossec-hids-071218.tar.gz 18-Dec-2007 22:50 585K
ossec-hids-080123.tar.gz 23-Jan-2008 10:29 585K
Cheers,
Richard
--On 01 February 2008 16:58 +0000 Roch <[EMAIL PROTECTED]> wrote:
>
> I had the same issues. Upgrading to the december snapshot fixed my
> problem.
>
> On 01/02/2008, Richard Hopkins <[EMAIL PROTECTED]> wrote:
>>
>>
>> Hi all,
>>
>> Since upgrading my (Solaris) ossec-hids server to version 1.4 I'm now
>> seeing the problem of the dying "maild" process. Never seen this problem
>> before.
>>
>> I'm currently running a "truss" (Solaris equivalent of strace) on the
>> process to see what, if anything, shows up.
>>
>> Cheers,
>>
>> Richard
>>
>>
>> --On 29 November 2007 21:06 -0400 Daniel Cid <[EMAIL PROTECTED]>
>> wrote:
>>
>> >
>> > Hi Pierre,
>> >
>> > Thanks for the information. I was able to find out where the bug is
>> > and the fix is available at:
>> >
>> > http://www.ossec.net/files/snapshots/ossec-hids-071129.tar.gz
>> >
>> >
>> > Just update to this new version and the problem should go away.
>> >
>> >
>> > Thanks,
>> >
>> > --
>> > Daniel B. Cid
>> > dcid ( at ) ossec.net
>> >
>> >
>> > On Nov 29, 2007 8:55 AM, Pierre Boisvert <[EMAIL PROTECTED]> wrote:
>> >>
>> >> Hi Daniel,
>> >>
>> >> Here the information you are requesting:
>> >>
>> >>
>> >> Result of the strace:
>> >>
>> >> read(4, "", 4096) = 0
>> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
>> >> read(4, "", 4096) = 0
>> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
>> >> read(4, "", 4096) = 0
>> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
>> >> read(4, "", 4096) = 0
>> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
>> >> read(4, "", 4096) = 0
>> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
>> >> read(4, "", 4096) = 0
>> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
>> >> read(4, "", 4096) = 0
>> >> select(0, NULL, NULL, NULL, {5, 0}) = 0 (Timeout)
>> >> time(NULL) = 1196312447
>> >> read(4, "", 4096) = 0
>> >> close(4) = 0
>> >> munmap(0xb7f88000, 4096) = 0
>> >> open("/logs/alerts/2007/Nov/ossec-alerts-29.log",
>> >> O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) ---
>> >> SIGSEGV (Segmentation fault) @ 0 (0) ---
>> >>
>> >>
>> >> Also, here the ossec.conf file: (clean from private information)
>> >>
>> >> Hope this help,
>> >>
>> >> ossec_config>
>> >> <global>
>> >> <email_notification>yes</email_notification>
>> >> <email_to>[EMAIL PROTECTED]</email_to>
>> >> <smtp_server>dddd.servername.com.</smtp_server>
>> >> <email_from>[EMAIL PROTECTED]</email_from>
>> >> </global>
>> >>
>> >> <email_alerts>
>> >> <email_to>[EMAIL PROTECTED]</email_to>
>> >> <rule_id>101702</rule_id>
>> >> <do_not_delay />
>> >> <do_not_group />
>> >> </email_alerts>
>> >>
>> >> <email_alerts>
>> >> <email_to>[EMAIL PROTECTED]</email_to>
>> >> <rule_id>101702</rule_id>
>> >> <do_not_delay />
>> >> <do_not_group />
>> >> </email_alerts>
>> >>
>> >>
>> >> <syscheck>
>> >> <!-- Frequency that syscheck is executed - default to every 6
>> >> hours --> <frequency>21600</frequency>
>> >>
>> >> <!-- Directories to check (perform all possible verifications)
>> >> --> <directories
>> >> check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
>> >> <directories check_all="yes">/bin,/sbin</directories>
>> >>
>> >> <!-- Files/directories to ignore -->
>> >> <ignore>/etc/mtab</ignore>
>> >> <ignore>/etc/mnttab</ignore>
>> >> <ignore>/etc/hosts.deny</ignore>
>> >> <ignore>/etc/mail/statistics</ignore>
>> >> <ignore>/etc/random-seed</ignore>
>> >> <ignore>/etc/adjtime</ignore>
>> >> <ignore>/etc/httpd/logs</ignore>
>> >> <ignore>/etc/utmpx</ignore>
>> >> <ignore>/etc/wtmpx</ignore>
>> >> <ignore>/etc/cups/certs</ignore>
>> >> <ignore>/etc/dumpdates</ignore>
>> >> <ignore>/etc/svc/volatile</ignore>
>> >>
>> >> <!-- Windows files to ignore -->
>> >> <ignore>C:\WINDOWS/System32/LogFiles</ignore>
>> >> <ignore>C:\WINDOWS/Debug</ignore>
>> >> <ignore>C:\WINDOWS/WindowsUpdate.log</ignore>
>> >> <ignore>C:\WINDOWS/iis6.log</ignore>
>> >> <ignore>C:\WINDOWS/system32/wbem/Logs</ignore>
>> >> <ignore>C:\WINDOWS/system32/wbem/Repository</ignore>
>> >> <ignore>C:\WINDOWS/Prefetch</ignore>
>> >> <ignore>C:\WINDOWS/PCHEALTH/HELPCTR/DataColl</ignore>
>> >> <ignore>C:\WINDOWS/SoftwareDistribution</ignore>
>> >> <ignore>C:\WINDOWS/Temp</ignore>
>> >> <ignore>C:\WINDOWS/system32/config</ignore>
>> >> <ignore>C:\WINDOWS/system32/spool</ignore>
>> >> <ignore>C:\WINDOWS/system32/CatRoot</ignore>
>> >> </syscheck>
>> >>
>> >> <rootcheck>
>> >> <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_f
>> >> ile s>
>> >> <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootk
>> >> it_ trojans> </rootcheck>
>> >>
>> >> <global>
>> >> <white_list>127.0.0.1</white_list>
>> >> <white_list>^localhost.localdomain$</white_list>
>> >> <white_list>X.X.X.X</white_list>
>> >> <white_list>X.X.X.X</white_list>
>> >> </global>
>> >>
>> >> <remote>
>> >> <connection>secure</connection>
>> >> </remote>
>> >>
>> >> <alerts>
>> >> <log_alert_level>1</log_alert_level>
>> >> <email_alert_level>7</email_alert_level>
>> >> </alerts>
>> >>
>> >> <command>
>> >> <name>host-deny</name>
>> >> <executable>host-deny.sh</executable>
>> >> <expect>srcip</expect>
>> >> <timeout_allowed>yes</timeout_allowed>
>> >> </command>
>> >>
>> >> <command>
>> >> <name>firewall-drop</name>
>> >> <executable>firewall-drop.sh</executable>
>> >> <expect>srcip</expect>
>> >> <timeout_allowed>yes</timeout_allowed>
>> >> </command>
>> >>
>> >> <command>
>> >> <name>disable-account</name>
>> >> <executable>disable-account.sh</executable>
>> >> <expect>user</expect>
>> >> <timeout_allowed>yes</timeout_allowed>
>> >> </command>
>> >>
>> >> <command>
>> >> <name>route-null</name>
>> >> <executable>route-null.sh</executable>
>> >> <expect>srcip</expect>
>> >> <timeout_allowed>yes</timeout_allowed>
>> >> </command>
>> >>
>> >>
>> >> <!-- Active Response Config -->
>> >> <active-response>
>> >> <!-- This response is going to execute the host-deny
>> >> - command for every event that fires a rule with
>> >> - level (severity) >= 6.
>> >> - The IP is going to be blocked for 600 seconds.
>> >> -->
>> >> <command>host-deny</command>
>> >> <location>local</location>
>> >> <level>6</level>
>> >> <timeout>600</timeout>
>> >> </active-response>
>> >>
>> >> <active-response>
>> >> <!-- Firewall Drop response. Block the IP for
>> >> - 600 seconds on the firewall (iptables,
>> >> - ipfilter, etc).
>> >> -->
>> >> <command>firewall-drop</command>
>> >> <location>local</location>
>> >> <level>6</level>
>> >> <timeout>600</timeout>
>> >> </active-response>
>> >>
>> >> <remote>
>> >> <connection>syslog</connection>
>> >> <port>514</port>
>> >> <allowed-ips>X.X.X.X</allowed-ips>
>> >> <allowed-ips>X.X.X.X</allowed-ips>
>> >> </remote>
>> >>
>> >> ----- Original Message ----
>> >> From: Daniel Cid <[EMAIL PROTECTED]>
>> >> To: [email protected]
>> >> Sent: Monday, November 26, 2007 9:05:51 PM
>> >> Subject: [ossec-list] Re: maild always stop running
>> >>
>> >>
>> >> Hi Pierre (and Aaron),
>> >>
>> >> Thanks for the report. I never saw similar behavior on ossec-maild, so
>> >> I would need a bit more information
>> >> to understand what is going on. Can you show us your config? Are you
>> >> using the granular e-mail alerts?
>> >>
>> >> If possible, can you stop ossec-maild and start it manually using:
>> >>
>> >>
>> >> # strace -f /var/ossec/bin/ossec-maild -d -d
>> >>
>> >>
>> >> -Or (gdb is preferred)
>> >>
>> >> # gdb /var/ossec/bin/ossec-maild
>> >> (gdb) set follow-fork-mode child
>> >> (gdb) run -d -d --> (after it crashes, run bt)
>> >> (gdb) bt
>> >>
>> >>
>> >> Thanks,
>> >>
>> >> --
>> >> Daniel B. Cid
>> >> dcid ( at ) ossec.net
>> >>
>> >>
>> >> On Nov 26, 2007 10:40 AM, Aaron Bliss <[EMAIL PROTECTED]> wrote:
>> >> >
>> >> > I'm actually seeing the same issue. Server is running on RedHat ES
>> >> > 5 box. No errors in the logs, the mailer daemon simply stops
>> >> > running after 4 or 5 days....
>> >> >
>> >> > Aaron
>> >> >
>> >> >
>> >> > Pierre Boisvert wrote:
>> >> > > Hi,
>> >> > >
>> >> > > I would to have some help to be able to find out why the maild
>> >> process on my Ossec server is always stopping.
>> >> > >
>> >> > > I'm running ossec on fedora 7, with Ossec-WUI. Everything else is
>> >> working fine. I don't see any message in the ossec.log file
>> >> regarding this issue.
>> >> > >
>> >> > > Thanks in advance
>> >> > >
>> >> > > Timononk
>> >> > >
>> >> > >
>> >> > >
>> >> > >
>> >> > > Get a sneak peak at messages with a handy reading pane with
>> >> All new Yahoo! Mail: http://mail.yahoo.ca
>> >> > >
>> >> >
>> >> > --
>> >> > Aaron Bliss
>> >> > Systems Administrator
>> >> > SUNY Brockport
>> >> > (585) 395-2417
>> >> >
>> >> >
>> >>
>> >>
>> >>
>> >>
>> >>
>> >> Looking for the perfect gift? Give the gift of Flickr!
>> >>
>> >> http://www.flickr.com/gift/
>> >>
>> >>
>>
>>
>>
>> Richard Hopkins
>> Information Services
>> University of Bristol
>>
>>
Richard Hopkins
Information Services
University of Bristol
