If you can get a coredump, a gdb analysis of the core file is useful
cat gdb.commands
bt
bt full
info threads
thread apply all bt
thread apply all bt full
quit
gdb rsyslogd corefile <gdb.commands
send the report directly to Rainer rather than the list (as it can contain
sensitive stuff). Looking at the output of these commands may give you a
clue as
to what functions are triggering the segfault.
I did see a patch for libfastjson that did not make it into a release yet
that
could cause a segfault in cases where a variable doesn't exist.
moving to 8.18 should move you from json-c to libfastjson, and that fixes
quite
a number of known segfaulting issues.
David Lang
On Wed, 20 Apr 2016, Christopher Racky wrote:
Date: Wed, 20 Apr 2016 14:18:25 +0200
From: Christopher Racky <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: [rsyslog] segfault with rsyslog Version > 8.16.0
Hello,
Thanks for all your great Support in the past!
Today I upgraded from rsyslog 8.16 over 8.17 to 8.18.
(As I noticed several Memory leaks in my Environment with arroung 10k
logs/sec)
I use a Red-Hat 6.7 Server with all latest patches installed.
Unfortunately during start of rsyslog I get the following message in
kernel ring-buffer.
Apr 20 13:15:09 demosrv kernel: rsyslogd[16640]: segfault at
7f3b276229d0 ip 00007f3b2cecb213 sp 00007fff3099bd30 error 4 in
libpthread-2.12.so[7f3b2cec3000+17000]
This message did not appear with rsyslog 8.16. Buf after an upgrade to
8.17 and with the latest version 8.18 I get this error.
Everythings seems to work fine, but whenever I do a restart, I get the
mentioned kernel error message.
Do you have any idear / hint?
How can I debug the issue?
My config is quite complex, so I just an excerpt about modules loaded:
---------------------------------------------------------------------------------------------------------
Module (load="imuxsock") # provides support for local system logging
(e.g. via logger command)
Module (load="imklog") # provides kernel logging support (previously
done by rklogd)
Module (load="impstats" interval="120" severity="7" log.syslog="on"
ruleset="pstats")
Module (load="imtcp" KeepAlive="on" KeepAlive.Probes="1"
KeepAlive.Interval="2" KeepAlive.Time="20" MaxSessions="5000")
Module (load="imudp")
Module (load="ommysql")
Module (load="omudpspoof")
Module (load="mmnormalize")
# Message Parsers
$modload pmlastmsg
$modload pmaixforwardedfrom
$rulesetparser rsyslog.lastline
$rulesetparser rsyslog.aixforwardedfrom
$rulesetparser rsyslog.rfc5424
$rulesetparser rsyslog.rfc3164
---------------------------------------------------------------------------------------------------------
[root@demosrv syslog]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.7 (Santiago)
[root@demosrv syslog]# yum update
Loaded plugins: product-id, refresh-packagekit, security,
subscription-manager
This system is not registered to Red Hat Subscription Management. You
can use subscription-manager to register.
Setting up Update Process
No Packages marked for Update
[root@demosrv syslog]# tail /var/log/messages
Apr 20 13:15:01 demosrv rsyslogd: [origin software="rsyslogd"
swVersion="8.17.0" x-pid="16640" x-info="http://www.rsyslog.com";]
exiting on signal 15.
Apr 20 13:15:09 demosrv kernel: rsyslogd[16640]: segfault at
7f3b276229d0 ip 00007f3b2cecb213 sp 00007fff3099bd30 error 4 in
libpthread-2.12.so[7f3b2cec3000+17000]
Apr 20 13:15:09 demosrv rsyslogd: [origin software="rsyslogd"
swVersion="8.17.0" x-pid="28237" x-info="http://www.rsyslog.com";]
start
Apr 20 14:01:32 demosrv yum[31727]: Updated: rsyslog-8.18.0-1.el6.x86_64
Apr 20 14:01:32 demosrv yum[31727]: Updated:
rsyslog-udpspoof-8.18.0-1.el6.x86_64
Apr 20 14:01:32 demosrv yum[31727]: Updated:
rsyslog-mysql-8.18.0-1.el6.x86_64
Apr 20 14:01:32 demosrv yum[31727]: Updated:
rsyslog-mmnormalize-8.18.0-1.el6.x86_64
Apr 20 14:01:32 demosrv yum[31727]: Updated:
rsyslog-pmaixforwardedfrom-8.18.0-1.el6.x86_64
Apr 20 14:01:33 demosrv rsyslogd: [origin software="rsyslogd"
swVersion="8.17.0" x-pid="28237" x-info="http://www.rsyslog.com";]
exiting on signal 15.
Apr 20 14:01:36 demosrv kernel: rsyslogd[28237]: segfault at
7f943a72f9d0 ip 00007f943ffd8213 sp 00007fff20878110 error 4 in
libpthread-2.12.so[7f943ffd0000+17000]
Apr 20 14:01:36 demosrv rsyslogd: [origin software="rsyslogd"
swVersion="8.18.0" x-pid="31782" x-info="http://www.rsyslog.com";]
start
Apr 20 14:02:25 demosrv rsyslogd: [origin software="rsyslogd"
swVersion="8.18.0" x-pid="31782" x-info="http://www.rsyslog.com";]
exiting on signal 15.
Apr 20 14:02:26 demosrv kernel: rsyslogd[31782]: segfault at
7fea41ef09d0 ip 00007fea47799213 sp 00007ffda216ff30 error 4 in
libpthread-2.12.so[7fea47791000+17000]
Apr 20 14:02:26 demosrv rsyslogd: [origin software="rsyslogd"
swVersion="8.18.0" x-pid="31897" x-info="http://www.rsyslog.com";]
start
------------------------------------------
regards
Chris
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
