Mailing List Archive

SIGSEGV in strlen rsyslog v8.1901.0
Hi,

I am observing crash in rsyslogd version 8.1901.0 (aka 2019.01). From the code it seems that pRes pointer is not validated before passing to strlen() where crash is observed(SEGV). Should NULL check be added for this pointer as it is getting assigned by functions like strdup, malloc etc, if they fail? Please suggest.

Following is the backtrace for the crash,



#0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85

85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.

[Current thread is 1 (LWP 15228)]

(gdb)

(gdb) bt

#0 0xb6ddb964 in ?? ()

#1 0x0048f64e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xb5cfe856,

ttNow=0x0) at msg.c:3720

#2 0x004be1f0 in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:1975

#3 cnfexprEval (expr=0xb352f8, ret=0xb5cfe8a8, usrptr=<optimized out>) at rainerscript.c:2505

#4 0x004bd75c in cnfexprEval (expr=0xb35310, ret=0xb5cfe920, usrptr=<optimized out>) at rainerscript.c:2099

#5 0x004bd4da in cnfexprEval (expr=0xb35368, ret=0xb5cfe970, usrptr=<optimized out>) at rainerscript.c:2454

#6 0x004c1f18 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0xb35300) at rainerscript.c:2660

#7 0x004a2d66 in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:257

#8 scriptExec (root=0xb32290, pMsg=0xb5d035d8, pWti=0xb328e0) at ruleset.c:549

#9 0x004a2808 in processBatch (pBatch=0xb32900, pWti=<optimized out>) at ruleset.c:595

#10 0x004ae854 in msgConsumer (notNeeded=<optimized out>, pBatch=0xb32900, pWti=0xb328e0) at rsyslogd.c:595

#11 0x0049ff38 in ConsumerReg (pThis=0xb2e3f0, pWti=<optimized out>) at queue.c:1982

#12 0x0049df1e in wtiWorker (pThis=0xb328e0) at wti.c:363

#13 0x0049da10 in wtpWorker (arg=0xb328e0) at wtp.c:389

#14 0xb6eb1550 in ?? ()

----------------------------------------
Regards,
Amrut Shetty


Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: SIGSEGV in strlen rsyslog v8.1901.0 [ In reply to ]
It would be best to create an issue for this at
https://github.com/rsyslog/rsyslog/issues Be sure to fill in the
required information so that all is available when needed.

I tried to make some sense out of the backtrace, but it doesn't point
into a location that looks right. For me, it points to "int jflag =
0;" in msg.c, which has neither pRes nor strlen() - also not around
them. Did you build yourself?

Depending on the location pRes != NULL may be an invariant, and so the
abort would be a follow-up error but not the root cause.

Rainer

El mar., 19 mar. 2019 a las 7:53, Amrut Shetty
(<sr.amrut@globaledgesoft.com>) escribió:
>
> Hi,
>
> I am observing crash in rsyslogd version 8.1901.0 (aka 2019.01). From the code it seems that pRes pointer is not validated before passing to strlen() where crash is observed(SEGV). Should NULL check be added for this pointer as it is getting assigned by functions like strdup, malloc etc, if they fail? Please suggest.
>
> Following is the backtrace for the crash,
>
>
>
> #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
>
> 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
>
> [Current thread is 1 (LWP 15228)]
>
> (gdb)
>
> (gdb) bt
>
> #0 0xb6ddb964 in ?? ()
>
> #1 0x0048f64e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xb5cfe856,
>
> ttNow=0x0) at msg.c:3720
>
> #2 0x004be1f0 in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:1975
>
> #3 cnfexprEval (expr=0xb352f8, ret=0xb5cfe8a8, usrptr=<optimized out>) at rainerscript.c:2505
>
> #4 0x004bd75c in cnfexprEval (expr=0xb35310, ret=0xb5cfe920, usrptr=<optimized out>) at rainerscript.c:2099
>
> #5 0x004bd4da in cnfexprEval (expr=0xb35368, ret=0xb5cfe970, usrptr=<optimized out>) at rainerscript.c:2454
>
> #6 0x004c1f18 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0xb35300) at rainerscript.c:2660
>
> #7 0x004a2d66 in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:257
>
> #8 scriptExec (root=0xb32290, pMsg=0xb5d035d8, pWti=0xb328e0) at ruleset.c:549
>
> #9 0x004a2808 in processBatch (pBatch=0xb32900, pWti=<optimized out>) at ruleset.c:595
>
> #10 0x004ae854 in msgConsumer (notNeeded=<optimized out>, pBatch=0xb32900, pWti=0xb328e0) at rsyslogd.c:595
>
> #11 0x0049ff38 in ConsumerReg (pThis=0xb2e3f0, pWti=<optimized out>) at queue.c:1982
>
> #12 0x0049df1e in wtiWorker (pThis=0xb328e0) at wti.c:363
>
> #13 0x0049da10 in wtpWorker (arg=0xb328e0) at wtp.c:389
>
> #14 0xb6eb1550 in ?? ()
>
> ----------------------------------------
> Regards,
> Amrut Shetty
>
>
> Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: SIGSEGV in strlen rsyslog v8.1901.0 [ In reply to ]
Sorry I added backtrace of older version of rsyslog. Here is backtrace for version 8.1901.0,

#0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
[Current thread is 1 (LWP 417)]

#0 0xa9353b64 in strlen () from /root_debug/rootfs/lib/libc.so.6
#1 0x0a8c3a1e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xa84fe85c,
ttNow=0x0) at msg.c:3808
#2 0x0a8b05fc in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:2767
#3 cnfexprEval (expr=0xc855830, ret=0xa84fe8c8, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3299
#4 0x0a8afd18 in cnfexprEval (expr=0xc853a60, ret=0xa84fe930, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:2893
#5 0x0a8afbae in cnfexprEval (expr=0xc853ab0, ret=0xa84fe978, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3248
#6 0x0a8b1900 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0x11, pWti=0xa84fe870) at rainerscript.c:3731
#7 0x0a8d88be in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:309
#8 scriptExec (root=0xc853a28, pMsg=0xa7910c68, pWti=0xc855d08) at ruleset.c:614
#9 0x0a8d82c0 in processBatch (pBatch=0xc855d28, pWti=<optimized out>) at ruleset.c:660
#10 0x0a89fffa in msgConsumer (notNeeded=<optimized out>, pBatch=0xc855d28, pWti=0xc855d08) at rsyslogd.c:714
#11 0x0a8d55cc in ConsumerReg (pThis=0xc84a490, pWti=<optimized out>) at queue.c:2111
#12 0x0a8d3126 in wtiWorker (pThis=0xc855d08) at wti.c:429
#13 0x0a8d27d2 in wtpWorker (arg=0xc855d08) at wtp.c:431
#14 0xa94317d0 in ?? () from /root_debug/rootfs/lib/libpthread.so.0

I will be creating issue too about this. I think by adding NULL checks we can avoid crashing of rsyslogd.
----------------------------------------
Regards,
Amrut Shetty



From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
To: "rsyslog" <rsyslog@lists.adiscon.com>
Sent: Tuesday, March 19, 2019 1:22:47 PM
Subject: Re: [rsyslog] SIGSEGV in strlen rsyslog v8.1901.0

It would be best to create an issue for this at
https://github.com/rsyslog/rsyslog/issues Be sure to fill in the
required information so that all is available when needed.

I tried to make some sense out of the backtrace, but it doesn't point
into a location that looks right. For me, it points to "int jflag =
0;" in msg.c, which has neither pRes nor strlen() - also not around
them. Did you build yourself?

Depending on the location pRes != NULL may be an invariant, and so the
abort would be a follow-up error but not the root cause.

Rainer

El mar., 19 mar. 2019 a las 7:53, Amrut Shetty
(<sr.amrut@globaledgesoft.com>) escribió:
>
> Hi,
>
> I am observing crash in rsyslogd version 8.1901.0 (aka 2019.01). From the code it seems that pRes pointer is not validated before passing to strlen() where crash is observed(SEGV). Should NULL check be added for this pointer as it is getting assigned by functions like strdup, malloc etc, if they fail? Please suggest.
>
> Following is the backtrace for the crash,
>
>
>
> #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
>
> 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
>
> [Current thread is 1 (LWP 15228)]
>
> (gdb)
>
> (gdb) bt
>
> #0 0xb6ddb964 in ?? ()
>
> #1 0x0048f64e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xb5cfe856,
>
> ttNow=0x0) at msg.c:3720
>
> #2 0x004be1f0 in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:1975
>
> #3 cnfexprEval (expr=0xb352f8, ret=0xb5cfe8a8, usrptr=<optimized out>) at rainerscript.c:2505
>
> #4 0x004bd75c in cnfexprEval (expr=0xb35310, ret=0xb5cfe920, usrptr=<optimized out>) at rainerscript.c:2099
>
> #5 0x004bd4da in cnfexprEval (expr=0xb35368, ret=0xb5cfe970, usrptr=<optimized out>) at rainerscript.c:2454
>
> #6 0x004c1f18 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0xb35300) at rainerscript.c:2660
>
> #7 0x004a2d66 in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:257
>
> #8 scriptExec (root=0xb32290, pMsg=0xb5d035d8, pWti=0xb328e0) at ruleset.c:549
>
> #9 0x004a2808 in processBatch (pBatch=0xb32900, pWti=<optimized out>) at ruleset.c:595
>
> #10 0x004ae854 in msgConsumer (notNeeded=<optimized out>, pBatch=0xb32900, pWti=0xb328e0) at rsyslogd.c:595
>
> #11 0x0049ff38 in ConsumerReg (pThis=0xb2e3f0, pWti=<optimized out>) at queue.c:1982
>
> #12 0x0049df1e in wtiWorker (pThis=0xb328e0) at wti.c:363
>
> #13 0x0049da10 in wtpWorker (arg=0xb328e0) at wtp.c:389
>
> #14 0xb6eb1550 in ?? ()
>
> ----------------------------------------
> Regards,
> Amrut Shetty
>
>
> Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: SIGSEGV in strlen rsyslog v8.1901.0 [ In reply to ]
El mar., 19 mar. 2019 a las 11:40, Amrut Shetty
(<sr.amrut@globaledgesoft.com>) escribió:
>
> Sorry I added backtrace of older version of rsyslog. Here is backtrace for version 8.1901.0,
>
> #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> [Current thread is 1 (LWP 417)]
>
> #0 0xa9353b64 in strlen () from /root_debug/rootfs/lib/libc.so.6
> #1 0x0a8c3a1e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xa84fe85c,
> ttNow=0x0) at msg.c:3808
> #2 0x0a8b05fc in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:2767
> #3 cnfexprEval (expr=0xc855830, ret=0xa84fe8c8, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3299
> #4 0x0a8afd18 in cnfexprEval (expr=0xc853a60, ret=0xa84fe930, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:2893
> #5 0x0a8afbae in cnfexprEval (expr=0xc853ab0, ret=0xa84fe978, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3248
> #6 0x0a8b1900 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0x11, pWti=0xa84fe870) at rainerscript.c:3731
> #7 0x0a8d88be in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:309
> #8 scriptExec (root=0xc853a28, pMsg=0xa7910c68, pWti=0xc855d08) at ruleset.c:614
> #9 0x0a8d82c0 in processBatch (pBatch=0xc855d28, pWti=<optimized out>) at ruleset.c:660
> #10 0x0a89fffa in msgConsumer (notNeeded=<optimized out>, pBatch=0xc855d28, pWti=0xc855d08) at rsyslogd.c:714
> #11 0x0a8d55cc in ConsumerReg (pThis=0xc84a490, pWti=<optimized out>) at queue.c:2111
> #12 0x0a8d3126 in wtiWorker (pThis=0xc855d08) at wti.c:429
> #13 0x0a8d27d2 in wtpWorker (arg=0xc855d08) at wtp.c:431
> #14 0xa94317d0 in ?? () from /root_debug/rootfs/lib/libpthread.so.0
>
> I will be creating issue too about this. I think by adding NULL checks we can avoid crashing of rsyslogd.

May be, may not. If it's not the root cause, this could worsen things.
But this we will see :-)

Thx,
Rainer
> ----------------------------------------
> Regards,
> Amrut Shetty
>
>
>
> From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
> To: "rsyslog" <rsyslog@lists.adiscon.com>
> Sent: Tuesday, March 19, 2019 1:22:47 PM
> Subject: Re: [rsyslog] SIGSEGV in strlen rsyslog v8.1901.0
>
> It would be best to create an issue for this at
> https://github.com/rsyslog/rsyslog/issues Be sure to fill in the
> required information so that all is available when needed.
>
> I tried to make some sense out of the backtrace, but it doesn't point
> into a location that looks right. For me, it points to "int jflag =
> 0;" in msg.c, which has neither pRes nor strlen() - also not around
> them. Did you build yourself?
>
> Depending on the location pRes != NULL may be an invariant, and so the
> abort would be a follow-up error but not the root cause.
>
> Rainer
>
> El mar., 19 mar. 2019 a las 7:53, Amrut Shetty
> (<sr.amrut@globaledgesoft.com>) escribió:
> >
> > Hi,
> >
> > I am observing crash in rsyslogd version 8.1901.0 (aka 2019.01). From the code it seems that pRes pointer is not validated before passing to strlen() where crash is observed(SEGV). Should NULL check be added for this pointer as it is getting assigned by functions like strdup, malloc etc, if they fail? Please suggest.
> >
> > Following is the backtrace for the crash,
> >
> >
> >
> > #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> >
> > 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> >
> > [Current thread is 1 (LWP 15228)]
> >
> > (gdb)
> >
> > (gdb) bt
> >
> > #0 0xb6ddb964 in ?? ()
> >
> > #1 0x0048f64e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xb5cfe856,
> >
> > ttNow=0x0) at msg.c:3720
> >
> > #2 0x004be1f0 in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:1975
> >
> > #3 cnfexprEval (expr=0xb352f8, ret=0xb5cfe8a8, usrptr=<optimized out>) at rainerscript.c:2505
> >
> > #4 0x004bd75c in cnfexprEval (expr=0xb35310, ret=0xb5cfe920, usrptr=<optimized out>) at rainerscript.c:2099
> >
> > #5 0x004bd4da in cnfexprEval (expr=0xb35368, ret=0xb5cfe970, usrptr=<optimized out>) at rainerscript.c:2454
> >
> > #6 0x004c1f18 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0xb35300) at rainerscript.c:2660
> >
> > #7 0x004a2d66 in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:257
> >
> > #8 scriptExec (root=0xb32290, pMsg=0xb5d035d8, pWti=0xb328e0) at ruleset.c:549
> >
> > #9 0x004a2808 in processBatch (pBatch=0xb32900, pWti=<optimized out>) at ruleset.c:595
> >
> > #10 0x004ae854 in msgConsumer (notNeeded=<optimized out>, pBatch=0xb32900, pWti=0xb328e0) at rsyslogd.c:595
> >
> > #11 0x0049ff38 in ConsumerReg (pThis=0xb2e3f0, pWti=<optimized out>) at queue.c:1982
> >
> > #12 0x0049df1e in wtiWorker (pThis=0xb328e0) at wti.c:363
> >
> > #13 0x0049da10 in wtpWorker (arg=0xb328e0) at wtp.c:389
> >
> > #14 0xb6eb1550 in ?? ()
> >
> > ----------------------------------------
> > Regards,
> > Amrut Shetty
> >
> >
> > Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
> Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: SIGSEGV in strlen rsyslog v8.1901.0 [ In reply to ]
I suppose sharing the rsyslog.conf and setup/steps to reproduce the
segfault would be more helpful than the stack backtrace (which the
developers can get themselves once they reproduce the crash).

Regards,
Satyam

On Tue, Mar 19, 2019 at 4:13 PM Rainer Gerhards
<rgerhards@hq.adiscon.com> wrote:
>
> El mar., 19 mar. 2019 a las 11:40, Amrut Shetty
> (<sr.amrut@globaledgesoft.com>) escribió:
> >
> > Sorry I added backtrace of older version of rsyslog. Here is backtrace for version 8.1901.0,
> >
> > #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> > 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> > [Current thread is 1 (LWP 417)]
> >
> > #0 0xa9353b64 in strlen () from /root_debug/rootfs/lib/libc.so.6
> > #1 0x0a8c3a1e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xa84fe85c,
> > ttNow=0x0) at msg.c:3808
> > #2 0x0a8b05fc in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:2767
> > #3 cnfexprEval (expr=0xc855830, ret=0xa84fe8c8, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3299
> > #4 0x0a8afd18 in cnfexprEval (expr=0xc853a60, ret=0xa84fe930, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:2893
> > #5 0x0a8afbae in cnfexprEval (expr=0xc853ab0, ret=0xa84fe978, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3248
> > #6 0x0a8b1900 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0x11, pWti=0xa84fe870) at rainerscript.c:3731
> > #7 0x0a8d88be in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:309
> > #8 scriptExec (root=0xc853a28, pMsg=0xa7910c68, pWti=0xc855d08) at ruleset.c:614
> > #9 0x0a8d82c0 in processBatch (pBatch=0xc855d28, pWti=<optimized out>) at ruleset.c:660
> > #10 0x0a89fffa in msgConsumer (notNeeded=<optimized out>, pBatch=0xc855d28, pWti=0xc855d08) at rsyslogd.c:714
> > #11 0x0a8d55cc in ConsumerReg (pThis=0xc84a490, pWti=<optimized out>) at queue.c:2111
> > #12 0x0a8d3126 in wtiWorker (pThis=0xc855d08) at wti.c:429
> > #13 0x0a8d27d2 in wtpWorker (arg=0xc855d08) at wtp.c:431
> > #14 0xa94317d0 in ?? () from /root_debug/rootfs/lib/libpthread.so.0
> >
> > I will be creating issue too about this. I think by adding NULL checks we can avoid crashing of rsyslogd.
>
> May be, may not. If it's not the root cause, this could worsen things.
> But this we will see :-)
>
> Thx,
> Rainer
> > ----------------------------------------
> > Regards,
> > Amrut Shetty
> >
> >
> >
> > From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
> > To: "rsyslog" <rsyslog@lists.adiscon.com>
> > Sent: Tuesday, March 19, 2019 1:22:47 PM
> > Subject: Re: [rsyslog] SIGSEGV in strlen rsyslog v8.1901.0
> >
> > It would be best to create an issue for this at
> > https://github.com/rsyslog/rsyslog/issues Be sure to fill in the
> > required information so that all is available when needed.
> >
> > I tried to make some sense out of the backtrace, but it doesn't point
> > into a location that looks right. For me, it points to "int jflag =
> > 0;" in msg.c, which has neither pRes nor strlen() - also not around
> > them. Did you build yourself?
> >
> > Depending on the location pRes != NULL may be an invariant, and so the
> > abort would be a follow-up error but not the root cause.
> >
> > Rainer
> >
> > El mar., 19 mar. 2019 a las 7:53, Amrut Shetty
> > (<sr.amrut@globaledgesoft.com>) escribió:
> > >
> > > Hi,
> > >
> > > I am observing crash in rsyslogd version 8.1901.0 (aka 2019.01). From the code it seems that pRes pointer is not validated before passing to strlen() where crash is observed(SEGV). Should NULL check be added for this pointer as it is getting assigned by functions like strdup, malloc etc, if they fail? Please suggest.
> > >
> > > Following is the backtrace for the crash,
> > >
> > >
> > >
> > > #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> > >
> > > 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> > >
> > > [Current thread is 1 (LWP 15228)]
> > >
> > > (gdb)
> > >
> > > (gdb) bt
> > >
> > > #0 0xb6ddb964 in ?? ()
> > >
> > > #1 0x0048f64e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xb5cfe856,
> > >
> > > ttNow=0x0) at msg.c:3720
> > >
> > > #2 0x004be1f0 in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:1975
> > >
> > > #3 cnfexprEval (expr=0xb352f8, ret=0xb5cfe8a8, usrptr=<optimized out>) at rainerscript.c:2505
> > >
> > > #4 0x004bd75c in cnfexprEval (expr=0xb35310, ret=0xb5cfe920, usrptr=<optimized out>) at rainerscript.c:2099
> > >
> > > #5 0x004bd4da in cnfexprEval (expr=0xb35368, ret=0xb5cfe970, usrptr=<optimized out>) at rainerscript.c:2454
> > >
> > > #6 0x004c1f18 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0xb35300) at rainerscript.c:2660
> > >
> > > #7 0x004a2d66 in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:257
> > >
> > > #8 scriptExec (root=0xb32290, pMsg=0xb5d035d8, pWti=0xb328e0) at ruleset.c:549
> > >
> > > #9 0x004a2808 in processBatch (pBatch=0xb32900, pWti=<optimized out>) at ruleset.c:595
> > >
> > > #10 0x004ae854 in msgConsumer (notNeeded=<optimized out>, pBatch=0xb32900, pWti=0xb328e0) at rsyslogd.c:595
> > >
> > > #11 0x0049ff38 in ConsumerReg (pThis=0xb2e3f0, pWti=<optimized out>) at queue.c:1982
> > >
> > > #12 0x0049df1e in wtiWorker (pThis=0xb328e0) at wti.c:363
> > >
> > > #13 0x0049da10 in wtpWorker (arg=0xb328e0) at wtp.c:389
> > >
> > > #14 0xb6eb1550 in ?? ()
> > >
> > > ----------------------------------------
> > > Regards,
> > > Amrut Shetty
> > >
> > >
> > > Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> >
> > Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: SIGSEGV in strlen rsyslog v8.1901.0 [ In reply to ]
El mar., 19 mar. 2019 a las 11:51, Satyam Sharma via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> I suppose sharing the rsyslog.conf and setup/steps to reproduce the
> segfault would be more helpful than the stack backtrace (which the
> developers can get themselves once they reproduce the crash).

It's actually both. The stack trace is useful for quick analysis and
verification.

Rainer
>
> Regards,
> Satyam
>
> On Tue, Mar 19, 2019 at 4:13 PM Rainer Gerhards
> <rgerhards@hq.adiscon.com> wrote:
> >
> > El mar., 19 mar. 2019 a las 11:40, Amrut Shetty
> > (<sr.amrut@globaledgesoft.com>) escribió:
> > >
> > > Sorry I added backtrace of older version of rsyslog. Here is backtrace for version 8.1901.0,
> > >
> > > #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> > > 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> > > [Current thread is 1 (LWP 417)]
> > >
> > > #0 0xa9353b64 in strlen () from /root_debug/rootfs/lib/libc.so.6
> > > #1 0x0a8c3a1e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xa84fe85c,
> > > ttNow=0x0) at msg.c:3808
> > > #2 0x0a8b05fc in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:2767
> > > #3 cnfexprEval (expr=0xc855830, ret=0xa84fe8c8, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3299
> > > #4 0x0a8afd18 in cnfexprEval (expr=0xc853a60, ret=0xa84fe930, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:2893
> > > #5 0x0a8afbae in cnfexprEval (expr=0xc853ab0, ret=0xa84fe978, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3248
> > > #6 0x0a8b1900 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0x11, pWti=0xa84fe870) at rainerscript.c:3731
> > > #7 0x0a8d88be in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:309
> > > #8 scriptExec (root=0xc853a28, pMsg=0xa7910c68, pWti=0xc855d08) at ruleset.c:614
> > > #9 0x0a8d82c0 in processBatch (pBatch=0xc855d28, pWti=<optimized out>) at ruleset.c:660
> > > #10 0x0a89fffa in msgConsumer (notNeeded=<optimized out>, pBatch=0xc855d28, pWti=0xc855d08) at rsyslogd.c:714
> > > #11 0x0a8d55cc in ConsumerReg (pThis=0xc84a490, pWti=<optimized out>) at queue.c:2111
> > > #12 0x0a8d3126 in wtiWorker (pThis=0xc855d08) at wti.c:429
> > > #13 0x0a8d27d2 in wtpWorker (arg=0xc855d08) at wtp.c:431
> > > #14 0xa94317d0 in ?? () from /root_debug/rootfs/lib/libpthread.so.0
> > >
> > > I will be creating issue too about this. I think by adding NULL checks we can avoid crashing of rsyslogd.
> >
> > May be, may not. If it's not the root cause, this could worsen things.
> > But this we will see :-)
> >
> > Thx,
> > Rainer
> > > ----------------------------------------
> > > Regards,
> > > Amrut Shetty
> > >
> > >
> > >
> > > From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
> > > To: "rsyslog" <rsyslog@lists.adiscon.com>
> > > Sent: Tuesday, March 19, 2019 1:22:47 PM
> > > Subject: Re: [rsyslog] SIGSEGV in strlen rsyslog v8.1901.0
> > >
> > > It would be best to create an issue for this at
> > > https://github.com/rsyslog/rsyslog/issues Be sure to fill in the
> > > required information so that all is available when needed.
> > >
> > > I tried to make some sense out of the backtrace, but it doesn't point
> > > into a location that looks right. For me, it points to "int jflag =
> > > 0;" in msg.c, which has neither pRes nor strlen() - also not around
> > > them. Did you build yourself?
> > >
> > > Depending on the location pRes != NULL may be an invariant, and so the
> > > abort would be a follow-up error but not the root cause.
> > >
> > > Rainer
> > >
> > > El mar., 19 mar. 2019 a las 7:53, Amrut Shetty
> > > (<sr.amrut@globaledgesoft.com>) escribió:
> > > >
> > > > Hi,
> > > >
> > > > I am observing crash in rsyslogd version 8.1901.0 (aka 2019.01). From the code it seems that pRes pointer is not validated before passing to strlen() where crash is observed(SEGV). Should NULL check be added for this pointer as it is getting assigned by functions like strdup, malloc etc, if they fail? Please suggest.
> > > >
> > > > Following is the backtrace for the crash,
> > > >
> > > >
> > > >
> > > > #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> > > >
> > > > 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> > > >
> > > > [Current thread is 1 (LWP 15228)]
> > > >
> > > > (gdb)
> > > >
> > > > (gdb) bt
> > > >
> > > > #0 0xb6ddb964 in ?? ()
> > > >
> > > > #1 0x0048f64e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xb5cfe856,
> > > >
> > > > ttNow=0x0) at msg.c:3720
> > > >
> > > > #2 0x004be1f0 in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:1975
> > > >
> > > > #3 cnfexprEval (expr=0xb352f8, ret=0xb5cfe8a8, usrptr=<optimized out>) at rainerscript.c:2505
> > > >
> > > > #4 0x004bd75c in cnfexprEval (expr=0xb35310, ret=0xb5cfe920, usrptr=<optimized out>) at rainerscript.c:2099
> > > >
> > > > #5 0x004bd4da in cnfexprEval (expr=0xb35368, ret=0xb5cfe970, usrptr=<optimized out>) at rainerscript.c:2454
> > > >
> > > > #6 0x004c1f18 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0xb35300) at rainerscript.c:2660
> > > >
> > > > #7 0x004a2d66 in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:257
> > > >
> > > > #8 scriptExec (root=0xb32290, pMsg=0xb5d035d8, pWti=0xb328e0) at ruleset.c:549
> > > >
> > > > #9 0x004a2808 in processBatch (pBatch=0xb32900, pWti=<optimized out>) at ruleset.c:595
> > > >
> > > > #10 0x004ae854 in msgConsumer (notNeeded=<optimized out>, pBatch=0xb32900, pWti=0xb328e0) at rsyslogd.c:595
> > > >
> > > > #11 0x0049ff38 in ConsumerReg (pThis=0xb2e3f0, pWti=<optimized out>) at queue.c:1982
> > > >
> > > > #12 0x0049df1e in wtiWorker (pThis=0xb328e0) at wti.c:363
> > > >
> > > > #13 0x0049da10 in wtpWorker (arg=0xb328e0) at wtp.c:389
> > > >
> > > > #14 0xb6eb1550 in ?? ()
> > > >
> > > > ----------------------------------------
> > > > Regards,
> > > > Amrut Shetty
> > > >
> > > >
> > > > Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > >
> > > Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> > >
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: SIGSEGV in strlen rsyslog v8.1901.0 [ In reply to ]
Hi,

Sorry for the delay, attached the rsyslog.conf file.
Unfortunately could not figure out the steps to reproduce the crash, it is occurring very rarely.

----------------------------------------
Regards,
Amrut Shetty

----- Original Message -----
From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
To: "rsyslog" <rsyslog@lists.adiscon.com>
Sent: Tuesday, March 19, 2019 4:42:42 PM
Subject: Re: [rsyslog] SIGSEGV in strlen rsyslog v8.1901.0

El mar., 19 mar. 2019 a las 11:51, Satyam Sharma via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> I suppose sharing the rsyslog.conf and setup/steps to reproduce the
> segfault would be more helpful than the stack backtrace (which the
> developers can get themselves once they reproduce the crash).

It's actually both. The stack trace is useful for quick analysis and
verification.

Rainer
>
> Regards,
> Satyam
>
> On Tue, Mar 19, 2019 at 4:13 PM Rainer Gerhards
> <rgerhards@hq.adiscon.com> wrote:
> >
> > El mar., 19 mar. 2019 a las 11:40, Amrut Shetty
> > (<sr.amrut@globaledgesoft.com>) escribió:
> > >
> > > Sorry I added backtrace of older version of rsyslog. Here is backtrace for version 8.1901.0,
> > >
> > > #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> > > 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> > > [Current thread is 1 (LWP 417)]
> > >
> > > #0 0xa9353b64 in strlen () from /root_debug/rootfs/lib/libc.so.6
> > > #1 0x0a8c3a1e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xa84fe85c,
> > > ttNow=0x0) at msg.c:3808
> > > #2 0x0a8b05fc in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:2767
> > > #3 cnfexprEval (expr=0xc855830, ret=0xa84fe8c8, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3299
> > > #4 0x0a8afd18 in cnfexprEval (expr=0xc853a60, ret=0xa84fe930, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:2893
> > > #5 0x0a8afbae in cnfexprEval (expr=0xc853ab0, ret=0xa84fe978, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3248
> > > #6 0x0a8b1900 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0x11, pWti=0xa84fe870) at rainerscript.c:3731
> > > #7 0x0a8d88be in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:309
> > > #8 scriptExec (root=0xc853a28, pMsg=0xa7910c68, pWti=0xc855d08) at ruleset.c:614
> > > #9 0x0a8d82c0 in processBatch (pBatch=0xc855d28, pWti=<optimized out>) at ruleset.c:660
> > > #10 0x0a89fffa in msgConsumer (notNeeded=<optimized out>, pBatch=0xc855d28, pWti=0xc855d08) at rsyslogd.c:714
> > > #11 0x0a8d55cc in ConsumerReg (pThis=0xc84a490, pWti=<optimized out>) at queue.c:2111
> > > #12 0x0a8d3126 in wtiWorker (pThis=0xc855d08) at wti.c:429
> > > #13 0x0a8d27d2 in wtpWorker (arg=0xc855d08) at wtp.c:431
> > > #14 0xa94317d0 in ?? () from /root_debug/rootfs/lib/libpthread.so.0
> > >
> > > I will be creating issue too about this. I think by adding NULL checks we can avoid crashing of rsyslogd.
> >
> > May be, may not. If it's not the root cause, this could worsen things.
> > But this we will see :-)
> >
> > Thx,
> > Rainer
> > > ----------------------------------------
> > > Regards,
> > > Amrut Shetty
> > >
> > >
> > >
> > > From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
> > > To: "rsyslog" <rsyslog@lists.adiscon.com>
> > > Sent: Tuesday, March 19, 2019 1:22:47 PM
> > > Subject: Re: [rsyslog] SIGSEGV in strlen rsyslog v8.1901.0
> > >
> > > It would be best to create an issue for this at
> > > https://github.com/rsyslog/rsyslog/issues Be sure to fill in the
> > > required information so that all is available when needed.
> > >
> > > I tried to make some sense out of the backtrace, but it doesn't point
> > > into a location that looks right. For me, it points to "int jflag =
> > > 0;" in msg.c, which has neither pRes nor strlen() - also not around
> > > them. Did you build yourself?
> > >
> > > Depending on the location pRes != NULL may be an invariant, and so the
> > > abort would be a follow-up error but not the root cause.
> > >
> > > Rainer
> > >
> > > El mar., 19 mar. 2019 a las 7:53, Amrut Shetty
> > > (<sr.amrut@globaledgesoft.com>) escribió:
> > > >
> > > > Hi,
> > > >
> > > > I am observing crash in rsyslogd version 8.1901.0 (aka 2019.01). From the code it seems that pRes pointer is not validated before passing to strlen() where crash is observed(SEGV). Should NULL check be added for this pointer as it is getting assigned by functions like strdup, malloc etc, if they fail? Please suggest.
> > > >
> > > > Following is the backtrace for the crash,
> > > >
> > > >
> > > >
> > > > #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> > > >
> > > > 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> > > >
> > > > [Current thread is 1 (LWP 15228)]
> > > >
> > > > (gdb)
> > > >
> > > > (gdb) bt
> > > >
> > > > #0 0xb6ddb964 in ?? ()
> > > >
> > > > #1 0x0048f64e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xb5cfe856,
> > > >
> > > > ttNow=0x0) at msg.c:3720
> > > >
> > > > #2 0x004be1f0 in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:1975
> > > >
> > > > #3 cnfexprEval (expr=0xb352f8, ret=0xb5cfe8a8, usrptr=<optimized out>) at rainerscript.c:2505
> > > >
> > > > #4 0x004bd75c in cnfexprEval (expr=0xb35310, ret=0xb5cfe920, usrptr=<optimized out>) at rainerscript.c:2099
> > > >
> > > > #5 0x004bd4da in cnfexprEval (expr=0xb35368, ret=0xb5cfe970, usrptr=<optimized out>) at rainerscript.c:2454
> > > >
> > > > #6 0x004c1f18 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0xb35300) at rainerscript.c:2660
> > > >
> > > > #7 0x004a2d66 in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:257
> > > >
> > > > #8 scriptExec (root=0xb32290, pMsg=0xb5d035d8, pWti=0xb328e0) at ruleset.c:549
> > > >
> > > > #9 0x004a2808 in processBatch (pBatch=0xb32900, pWti=<optimized out>) at ruleset.c:595
> > > >
> > > > #10 0x004ae854 in msgConsumer (notNeeded=<optimized out>, pBatch=0xb32900, pWti=0xb328e0) at rsyslogd.c:595
> > > >
> > > > #11 0x0049ff38 in ConsumerReg (pThis=0xb2e3f0, pWti=<optimized out>) at queue.c:1982
> > > >
> > > > #12 0x0049df1e in wtiWorker (pThis=0xb328e0) at wti.c:363
> > > >
> > > > #13 0x0049da10 in wtpWorker (arg=0xb328e0) at wtp.c:389
> > > >
> > > > #14 0xb6eb1550 in ?? ()
> > > >
> > > > ----------------------------------------
> > > > Regards,
> > > > Amrut Shetty
> > > >
> > > >
> > > > Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > >
> > > Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> > >
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
Re: SIGSEGV in strlen rsyslog v8.1901.0 [ In reply to ]
Hi,

Does the conf file provides any additional info to figure out the crash. If it is OOM issue is it ok to let rsyslog crash like this? Please suggest.

----------------------------------------
Regards,
Amrut Shetty

----- Original Message -----
From: "rsyslog" <rsyslog@lists.adiscon.com>
To: "rsyslog" <rsyslog@lists.adiscon.com>
Cc: "Amrut Shetty" <sr.amrut@globaledgesoft.com>
Sent: Tuesday, April 9, 2019 7:22:30 PM
Subject: Re: [rsyslog] SIGSEGV in strlen rsyslog v8.1901.0

Hi,

Sorry for the delay, attached the rsyslog.conf file.
Unfortunately could not figure out the steps to reproduce the crash, it is occurring very rarely.

----------------------------------------
Regards,
Amrut Shetty

----- Original Message -----
From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
To: "rsyslog" <rsyslog@lists.adiscon.com>
Sent: Tuesday, March 19, 2019 4:42:42 PM
Subject: Re: [rsyslog] SIGSEGV in strlen rsyslog v8.1901.0

El mar., 19 mar. 2019 a las 11:51, Satyam Sharma via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> I suppose sharing the rsyslog.conf and setup/steps to reproduce the
> segfault would be more helpful than the stack backtrace (which the
> developers can get themselves once they reproduce the crash).

It's actually both. The stack trace is useful for quick analysis and
verification.

Rainer
>
> Regards,
> Satyam
>
> On Tue, Mar 19, 2019 at 4:13 PM Rainer Gerhards
> <rgerhards@hq.adiscon.com> wrote:
> >
> > El mar., 19 mar. 2019 a las 11:40, Amrut Shetty
> > (<sr.amrut@globaledgesoft.com>) escribió:
> > >
> > > Sorry I added backtrace of older version of rsyslog. Here is backtrace for version 8.1901.0,
> > >
> > > #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> > > 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> > > [Current thread is 1 (LWP 417)]
> > >
> > > #0 0xa9353b64 in strlen () from /root_debug/rootfs/lib/libc.so.6
> > > #1 0x0a8c3a1e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xa84fe85c,
> > > ttNow=0x0) at msg.c:3808
> > > #2 0x0a8b05fc in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:2767
> > > #3 cnfexprEval (expr=0xc855830, ret=0xa84fe8c8, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3299
> > > #4 0x0a8afd18 in cnfexprEval (expr=0xc853a60, ret=0xa84fe930, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:2893
> > > #5 0x0a8afbae in cnfexprEval (expr=0xc853ab0, ret=0xa84fe978, usrptr=<optimized out>, pWti=<optimized out>) at rainerscript.c:3248
> > > #6 0x0a8b1900 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0x11, pWti=0xa84fe870) at rainerscript.c:3731
> > > #7 0x0a8d88be in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:309
> > > #8 scriptExec (root=0xc853a28, pMsg=0xa7910c68, pWti=0xc855d08) at ruleset.c:614
> > > #9 0x0a8d82c0 in processBatch (pBatch=0xc855d28, pWti=<optimized out>) at ruleset.c:660
> > > #10 0x0a89fffa in msgConsumer (notNeeded=<optimized out>, pBatch=0xc855d28, pWti=0xc855d08) at rsyslogd.c:714
> > > #11 0x0a8d55cc in ConsumerReg (pThis=0xc84a490, pWti=<optimized out>) at queue.c:2111
> > > #12 0x0a8d3126 in wtiWorker (pThis=0xc855d08) at wti.c:429
> > > #13 0x0a8d27d2 in wtpWorker (arg=0xc855d08) at wtp.c:431
> > > #14 0xa94317d0 in ?? () from /root_debug/rootfs/lib/libpthread.so.0
> > >
> > > I will be creating issue too about this. I think by adding NULL checks we can avoid crashing of rsyslogd.
> >
> > May be, may not. If it's not the root cause, this could worsen things.
> > But this we will see :-)
> >
> > Thx,
> > Rainer
> > > ----------------------------------------
> > > Regards,
> > > Amrut Shetty
> > >
> > >
> > >
> > > From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
> > > To: "rsyslog" <rsyslog@lists.adiscon.com>
> > > Sent: Tuesday, March 19, 2019 1:22:47 PM
> > > Subject: Re: [rsyslog] SIGSEGV in strlen rsyslog v8.1901.0
> > >
> > > It would be best to create an issue for this at
> > > https://github.com/rsyslog/rsyslog/issues Be sure to fill in the
> > > required information so that all is available when needed.
> > >
> > > I tried to make some sense out of the backtrace, but it doesn't point
> > > into a location that looks right. For me, it points to "int jflag =
> > > 0;" in msg.c, which has neither pRes nor strlen() - also not around
> > > them. Did you build yourself?
> > >
> > > Depending on the location pRes != NULL may be an invariant, and so the
> > > abort would be a follow-up error but not the root cause.
> > >
> > > Rainer
> > >
> > > El mar., 19 mar. 2019 a las 7:53, Amrut Shetty
> > > (<sr.amrut@globaledgesoft.com>) escribió:
> > > >
> > > > Hi,
> > > >
> > > > I am observing crash in rsyslogd version 8.1901.0 (aka 2019.01). From the code it seems that pRes pointer is not validated before passing to strlen() where crash is observed(SEGV). Should NULL check be added for this pointer as it is getting assigned by functions like strdup, malloc etc, if they fail? Please suggest.
> > > >
> > > > Following is the backtrace for the crash,
> > > >
> > > >
> > > >
> > > > #0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:85
> > > >
> > > > 85 ../sysdeps/arm/armv6t2/strlen.S: No such file or directory.
> > > >
> > > > [Current thread is 1 (LWP 15228)]
> > > >
> > > > (gdb)
> > > >
> > > > (gdb) bt
> > > >
> > > > #0 0xb6ddb964 in ?? ()
> > > >
> > > > #1 0x0048f64e in MsgGetProp (pMsg=<optimized out>, pTpe=0x0, pProp=<optimized out>, pPropLen=<optimized out>, pbMustBeFreed=0xb5cfe856,
> > > >
> > > > ttNow=0x0) at msg.c:3720
> > > >
> > > > #2 0x004be1f0 in evalVar (var=<optimized out>, usrptr=<optimized out>, ret=<optimized out>) at rainerscript.c:1975
> > > >
> > > > #3 cnfexprEval (expr=0xb352f8, ret=0xb5cfe8a8, usrptr=<optimized out>) at rainerscript.c:2505
> > > >
> > > > #4 0x004bd75c in cnfexprEval (expr=0xb35310, ret=0xb5cfe920, usrptr=<optimized out>) at rainerscript.c:2099
> > > >
> > > > #5 0x004bd4da in cnfexprEval (expr=0xb35368, ret=0xb5cfe970, usrptr=<optimized out>) at rainerscript.c:2454
> > > >
> > > > #6 0x004c1f18 in cnfexprEvalBool (expr=0xfffffff8, usrptr=0xb35300) at rainerscript.c:2660
> > > >
> > > > #7 0x004a2d66 in execIf (stmt=<optimized out>, pMsg=<optimized out>, pWti=<optimized out>) at ruleset.c:257
> > > >
> > > > #8 scriptExec (root=0xb32290, pMsg=0xb5d035d8, pWti=0xb328e0) at ruleset.c:549
> > > >
> > > > #9 0x004a2808 in processBatch (pBatch=0xb32900, pWti=<optimized out>) at ruleset.c:595
> > > >
> > > > #10 0x004ae854 in msgConsumer (notNeeded=<optimized out>, pBatch=0xb32900, pWti=0xb328e0) at rsyslogd.c:595
> > > >
> > > > #11 0x0049ff38 in ConsumerReg (pThis=0xb2e3f0, pWti=<optimized out>) at queue.c:1982
> > > >
> > > > #12 0x0049df1e in wtiWorker (pThis=0xb328e0) at wti.c:363
> > > >
> > > > #13 0x0049da10 in wtpWorker (arg=0xb328e0) at wtp.c:389
> > > >
> > > > #14 0xb6eb1550 in ?? ()
> > > >
> > > > ----------------------------------------
> > > > Regards,
> > > > Amrut Shetty
> > > >
> > > >
> > > > Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > >
> > > Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.
> > >
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.


_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Disclaimer:- The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. The views expressed in this E-mail message (including the enclosure/(s) or attachment/(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of GlobalEdge. Before opening any mail and attachments please check them for viruses .GlobalEdge does not accept any liability for virus infected mails.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.