A new bug found.
When I tried to use file mask in logcheck config, I got segfault again!
Let configure:
> <localfile>
> <log_format>apache</log_format>
> <location>/var/log/nginx/*.log</location>
> </localfile>
>
And suppose we have a few (or lot :) ) log files in directory (in any case
more than two)
Lets start ossec. Oops! We got a segfault on read config step!
Patch to fix that in attachment. IMO, stupid mistake made by developers :(
- they used incorrect variable name and do not correctly init variables,
when check globs.
--- ossec-hids-2.7-beta-0/src/config/localfile-config.c.orig 2012-09-21 08:28:41.000000000 -0400
+++ ossec-hids-2.7-beta-0/src/config/localfile-config.c 2012-09-21 08:26:19.000000000 -0400
@@ -197,8 +197,8 @@
os_realloc(logf, (pl +2)*sizeof(logreader), log_config->config);
logf = log_config->config;
- logf[pl].file = logf[pl].ffile = logf[pl].alias = NULL;
- logf[pl+1].file = logf[pl+1].ffile = logf[pl+1].alias = NULL;
+ logf[pl].file = logf[pl].ffile = logf[pl].alias = logf[pl].logformat = NULL;
+ logf[pl+1].file = logf[pl+1].ffile = logf[pl+1].alias = logf[pl].logformat = NULL;
/* We can not increment the file count in here */
continue;
@@ -413,7 +413,7 @@
char *format;
/* Getting log format */
- if(logf[pl].logformat)
+ if(logf[glob_set].logformat)
{
format = logf[pl].logformat;
}
