Skip to content

Segmentation fault at logcollector #829

@vikman90

Description

@vikman90

ossec-logcollector stops suddenly after some log rotations, and it shows always the following error:

ERROR: Could not open file '/root/testing.log' due to [(2)-(No such file or directory)].

This is caused by a segmentation fault. This is the output from Valgrind:

2016/05/05 10:15:20 ossec-logcollector(1103): ERROR: Could not open file '/root/testing.log' due to [(2)-(No such file or directory)].
==5382== Invalid read of size 4
==5382== at 0x5A1B570: fileno (in /usr/lib64/libc-2.17.so)
==5382== by 0x4065CE: LogCollectorStart (logcollector.c:404)
==5382== by 0x404788: main (main.c:163)
==5382== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==5382==
==5382==
==5382== Process terminating with default action of signal 11 (SIGSEGV)
==5382== Access not within mapped region at address 0x0
==5382== at 0x5A1B570: fileno (in /usr/lib64/libc-2.17.so)
==5382== by 0x4065CE: LogCollectorStart (logcollector.c:404)
==5382== by 0x404788: main (main.c:163)
==5382== If you believe this happened as a result of a stack
==5382== overflow in your program's main thread (unlikely but
==5382== possible), you can try to increase the size of the
==5382== main thread stack using the --main-stacksize= flag.
==5382== The main thread stack size used in this run was 8388608.

It appears to happen when a monitored file is removed and Logcollector can't find it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions