I'm in them middle of upgrading some high load servers to rsyslog 8.18 - and have some fairly complex configs on them. I'll keep an eye on on things today and report back how it goes.
On Wed, Apr 20, 2016 at 12:31 PM David Lang <[email protected]> wrote: > If you can get a coredump, a gdb analysis of the core file is useful > > cat gdb.commands > bt > bt full > info threads > thread apply all bt > thread apply all bt full > quit > > > > gdb rsyslogd corefile <gdb.commands > > send the report directly to Rainer rather than the list (as it can contain > sensitive stuff). Looking at the output of these commands may give you a > clue as > to what functions are triggering the segfault. > > I did see a patch for libfastjson that did not make it into a release yet > that > could cause a segfault in cases where a variable doesn't exist. > > moving to 8.18 should move you from json-c to libfastjson, and that fixes > quite > a number of known segfaulting issues. > > David Lang > > > On Wed, 20 Apr 2016, Christopher Racky wrote: > > > Date: Wed, 20 Apr 2016 14:18:25 +0200 > > From: Christopher Racky <[email protected]> > > Reply-To: rsyslog-users <[email protected]> > > To: rsyslog-users <[email protected]> > > Subject: [rsyslog] segfault with rsyslog Version > 8.16.0 > > > > Hello, > > > > Thanks for all your great Support in the past! > > > > Today I upgraded from rsyslog 8.16 over 8.17 to 8.18. > > (As I noticed several Memory leaks in my Environment with arroung 10k > logs/sec) > > I use a Red-Hat 6.7 Server with all latest patches installed. > > > > Unfortunately during start of rsyslog I get the following message in > > kernel ring-buffer. > > Apr 20 13:15:09 demosrv kernel: rsyslogd[16640]: segfault at > > 7f3b276229d0 ip 00007f3b2cecb213 sp 00007fff3099bd30 error 4 in > > libpthread-2.12.so[7f3b2cec3000+17000] > > > > This message did not appear with rsyslog 8.16. Buf after an upgrade to > > 8.17 and with the latest version 8.18 I get this error. > > Everythings seems to work fine, but whenever I do a restart, I get the > > mentioned kernel error message. > > > > > > Do you have any idear / hint? > > How can I debug the issue? > > > > > > My config is quite complex, so I just an excerpt about modules loaded: > > > --------------------------------------------------------------------------------------------------------- > > Module (load="imuxsock") # provides support for local system logging > > (e.g. via logger command) > > Module (load="imklog") # provides kernel logging support (previously > > done by rklogd) > > Module (load="impstats" interval="120" severity="7" log.syslog="on" > > ruleset="pstats") > > Module (load="imtcp" KeepAlive="on" KeepAlive.Probes="1" > > KeepAlive.Interval="2" KeepAlive.Time="20" MaxSessions="5000") > > Module (load="imudp") > > Module (load="ommysql") > > Module (load="omudpspoof") > > Module (load="mmnormalize") > > > > # Message Parsers > > $modload pmlastmsg > > $modload pmaixforwardedfrom > > $rulesetparser rsyslog.lastline > > $rulesetparser rsyslog.aixforwardedfrom > > $rulesetparser rsyslog.rfc5424 > > $rulesetparser rsyslog.rfc3164 > > > --------------------------------------------------------------------------------------------------------- > > > > > > [root@demosrv syslog]# cat /etc/redhat-release > > Red Hat Enterprise Linux Server release 6.7 (Santiago) > > [root@demosrv syslog]# yum update > > Loaded plugins: product-id, refresh-packagekit, security, > subscription-manager > > This system is not registered to Red Hat Subscription Management. You > > can use subscription-manager to register. > > Setting up Update Process > > No Packages marked for Update > > [root@demosrv syslog]# tail /var/log/messages > > Apr 20 13:15:01 demosrv rsyslogd: [origin software="rsyslogd" > > swVersion="8.17.0" x-pid="16640" x-info="http://www.rsyslog.com";] > > exiting on signal 15. > > Apr 20 13:15:09 demosrv kernel: rsyslogd[16640]: segfault at > > 7f3b276229d0 ip 00007f3b2cecb213 sp 00007fff3099bd30 error 4 in > > libpthread-2.12.so[7f3b2cec3000+17000] > > Apr 20 13:15:09 demosrv rsyslogd: [origin software="rsyslogd" > > swVersion="8.17.0" x-pid="28237" x-info="http://www.rsyslog.com";] > > start > > Apr 20 14:01:32 demosrv yum[31727]: Updated: rsyslog-8.18.0-1.el6.x86_64 > > Apr 20 14:01:32 demosrv yum[31727]: Updated: > > rsyslog-udpspoof-8.18.0-1.el6.x86_64 > > Apr 20 14:01:32 demosrv yum[31727]: Updated: > rsyslog-mysql-8.18.0-1.el6.x86_64 > > Apr 20 14:01:32 demosrv yum[31727]: Updated: > > rsyslog-mmnormalize-8.18.0-1.el6.x86_64 > > Apr 20 14:01:32 demosrv yum[31727]: Updated: > > rsyslog-pmaixforwardedfrom-8.18.0-1.el6.x86_64 > > Apr 20 14:01:33 demosrv rsyslogd: [origin software="rsyslogd" > > swVersion="8.17.0" x-pid="28237" x-info="http://www.rsyslog.com";] > > exiting on signal 15. > > Apr 20 14:01:36 demosrv kernel: rsyslogd[28237]: segfault at > > 7f943a72f9d0 ip 00007f943ffd8213 sp 00007fff20878110 error 4 in > > libpthread-2.12.so[7f943ffd0000+17000] > > Apr 20 14:01:36 demosrv rsyslogd: [origin software="rsyslogd" > > swVersion="8.18.0" x-pid="31782" x-info="http://www.rsyslog.com";] > > start > > Apr 20 14:02:25 demosrv rsyslogd: [origin software="rsyslogd" > > swVersion="8.18.0" x-pid="31782" x-info="http://www.rsyslog.com";] > > exiting on signal 15. > > Apr 20 14:02:26 demosrv kernel: rsyslogd[31782]: segfault at > > 7fea41ef09d0 ip 00007fea47799213 sp 00007ffda216ff30 error 4 in > > libpthread-2.12.so[7fea47791000+17000] > > Apr 20 14:02:26 demosrv rsyslogd: [origin software="rsyslogd" > > swVersion="8.18.0" x-pid="31897" x-info="http://www.rsyslog.com";] > > start > > ------------------------------------------ > > > > regards > > Chris > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
