Had a major network issue earlier in the week, one of the fallout victims was my syslog-ng server. I'm currently running the latest package from EPEL. It crashed and coredumped a few times during the network outage. I've only had the chance to dissect the one that seems the most signifigant to me, the SIGSEGV segfault.
Here is the syslog-ng version output. This is the latest version available.
I took the core file generated by abrtd and ran it through a few utilities, most notably the GDB. Doing that you can see that there is a missing header file; /usr/include/iv_list.h.$ syslog-ng --version
syslog-ng 3.5.6
Installer-Version: 3.5.6
Revision:
Compile-Date: Dec 30 2015 19:57:24
Available-Modules: affile,afprog,afsocket-notls,afsocket-tls,afsocket,afstomp,afuser,basicfuncs,confgen,cryptofuncs,csvparser,dbparser,linux-kmsg-format,syslogformat,system-source
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: on
Enable-Linux-Caps: on
Enable-Pcre: on
My background is all systems admin, not programming. It makes sense to me that a missing header during the compilation would result in missing functionality, and therefore missing memory mapping within the syslog-ng binary. It seems reasonable that this would result in a SIGSEGV segfault when the function called references a function that is not available.
In the interest of keeping the post to a reasonable length, I'm just including the relevant lines from GDB below.
Code: Select all
# gdb $(which syslog-ng) coredump
....
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/sbin/syslog-ng -F -p /var/run/syslogd.pid'.
Program terminated with signal 11, Segmentation fault.
#0 __iv_list_splice (next=0xfac550, prev=0xfac550, ilh=0xfac5c0) at /usr/include/iv_list.h:92
92 /usr/include/iv_list.h: No such file or directory.
Missing separate debuginfos, use: debuginfo-install bzip2-libs-1.0.6-13.el7.x86_64 elfutils-libelf-0.168-8.el7.x86_64 elfutils-libs-0.168-8.el7.x86_64 eventlog-0.2.13-4.el7.x86_64 glib2-2.50.3-3.el7.x86_64 glibc-2.17-196.el7_4.2.x86_64 ivykis-0.36.2-2.el7.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 krb5-libs-1.15.1-8.el7.x86_64 libattr-2.4.46-12.el7.x86_64 libcap-2.22-9.el7.x86_64 libcom_err-1.42.9-10.el7.x86_64 libgcc-4.8.5-16.el7_4.1.x86_64 libgcrypt-1.5.3-14.el7.x86_64 libgpg-error-1.12-3.el7.x86_64 libnet-1.1.6-7.el7.x86_64 libselinux-2.5-11.el7.x86_64 libuuid-2.23.2-43.el7_4.2.x86_64 openssl-libs-1.0.2k-8.el7.x86_64 pcre-8.32-17.el7.x86_64 systemd-libs-219-42.el7_4.4.x86_64 tcp_wrappers-libs-7.6-77.el7.x86_64 xz-libs-5.2.2-1.el7.x86_64 zlib-1.2.7-17.el7.x86_64
(gdb) info frame 0
Stack frame at 0x7fe9ba966a30:
rip = 0x7fe9c109867e in __iv_list_splice (/usr/include/iv_list.h:92); saved rip 0x7fe9c1098ea1
inlined into frame 1
source language c.
Arglist at unknown address.
Locals at unknown address, Previous frame's sp in rsp
So, down to the questions -
Am I on the right track here? I want to prevent this from happening again if I can, what are the next steps? Does this look like a bug (never had much luck filing these)? If I need to consult elsewhere (EPEL is Fedora right?), please let me know!