[ossec-list] Re: OSSEC-CONTROL Segfault message

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Mario,

Thanks for the information and the report. I found the problem and it
is actually in one of the error messages incorrectly formatted. It
will
be fixed in the next version.

Btw, you should probably use the latest version:

http://www.ossec.net/files/ossec-hids-0.8-3.tar.gz

Thanks,

--
Daniel B. Cid
dcid @ ( at ) ossec.net


On 6/22/06, Mário Roberto Ginglass <ginglass@xxxxxxxxx> wrote:
>
> Daniel,
>
> I instaled version 0.8.
> [root@xpto]# md5sum /usr/src/ossec-hids-0.8.tar.gz
> 22a98f9885c1a79759688c35c6805aa9
> /usr/src/ossec-hids-0.8.tar.gz
>
> It is running on:
> Linux xpto.com.br 2.6.15-1.1831_FC4smp #1 SMP Tue Feb 7 13:51:52 EST 2006
> x86_64 x86_64 x86_64 GNU/Linux
>
> [root@xpto]# ../bin/ossec-logcollector
> 2006/06/22 14:47:03 Falha de segmentação
>
> strace:
> (...)
> open("/var/ossec/logs/ossec.log",
> O_WRONLY|O_APPEND|O_CREAT, 0666) = 3
> fstat(3, {st_mode=S_IFREG|0664, st_size=22382, ...}) = 0
> mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
> 0x2aaaaaaac000
> fstat(3, {st_mode=S_IFREG|0664, st_size=22382, ...}) = 0
> lseek(3, 22382, SEEK_SET)               = 22382
> write(3, "2006/06/22 14:47:41 ossec-logcol"..., 97) = 97
> close(3)                                = 0
> munmap(0x2aaaaaaac000, 4096)            = 0
> write(2, "2006/06/22 14:47:41 ", 202006/06/22 14:47:41 )    = 20
> --- SIGSEGV (Segmentation fault) @ 0 (0) ---
> +++ killed by SIGSEGV +++
>
> There is no other message at ossec.log. Just, as I told before:
> 2006/06/22 14:47:41 ossec-logcollector(1236): Maximum number of elements
> reached for: localfile.
>
> Regards,
> Mario
>
>
>
> On 6/22/06, Daniel Cid <daniel.cid@xxxxxxxxx> wrote:
> > Hey,
> >
> > This is strange.. The maximum number of allowed files by default is 16
> > and when it is reached, no segmentation fault should occur (because we
> > check for it and exit). Maybe there is another problem there...
> >
> > -Which version of ossec are you using?
> > -If you add the other files back and execute
> :/var/ossec/bin/ossec-logcollector
> > does it segfaults?
> > -Is there any other error in the logs?
> >
> > Thanks,
> >
> > --
> > Daniel B. Cid
> > dcid @ ( at ) ossec.net
> >
> > On 6/22/06, ginglass <ginglass@xxxxxxxxx > wrote:
> > >
> > > Just a tip, OSSEC Segfault if I have more then 13 localfiles.
> > > I could accept this limit but I (as a newbie) expect a better error
> > > message (just like in ossec.log).
> > > root@xpto ~]# /etc/init.d/ossec start
> > > Starting OSSEC: 2006/06/22 12:38:01 /var/ossec/bin/ossec-control: line
> > > 52: 19525 Falha de segmentação    ${DIR}/bin/${i} -t
> > >                      [FALHOU]
> > >
> > > It is better in logfile ossec.log:
> > > 2006/06/22 12:32:01 ossec-logcollector(1236): Maximum number of
> > > elements reached for: localfile
> > >
> > > Tnks,
> > > Mario
> > >
> > >
> > >
> > > >
> >
>

--~--~---------~--~----~------------~-------~--~----~
-~----------~----~----~----~------~----~------~--~---