Mailing List Archive

rsyslogd crashes when log files are rotated (and how to debug)
Hi all

I encounter crashes very frequently with rsyslog(8.2102 to 8.2106) and file
rotation.

The details are recorded in issue
https://github.com/rsyslog/rsyslog/issues/4625

I have been trying to debug the issue for a few days, but I can not catch a
crash.

When I use gdb to attach to rsyslogd process, the crash never occurs, just
error logs saying about "rsyslogd: imfile: internal error? inotify provided
watch descriptor 20 which we could not find in our tables"

If I set `hard/soft core unlimited` in `/etc/security/limits.d/`, there is
no core dump file written, only crash logs in dmesg like:

```
[Fri Jul 2 22:22:00 2021] traps: rsyslogd[13402] general protection
ip:7f812e7369bd sp:7ffee571f370 error:0 in libc-2.28.so[7f812e6d4000+148000]
```

or

```
[Sat Jul 3 00:01:04 2021] rsyslogd[5909]: segfault at 5f ip
00007f07cad8a9bd sp 00007ffcab29d550 error 4 in libc-2.28.so
[7f07cad28000+148000]
[Sat Jul 3 00:01:04 2021] Code: 89 ee 48 89 df 5b 5d e9 11 fd ff ff 90 53
48 83 ec 10 48 8b 05 4c 65 13 00 48 8b 00 48 85 c0 0f 85 88 00 00 00 48 85
ff 74 73 <48> 8b 47 f8 48 8d 77 f0 a8 02 75 37 48 8b 15 a8 63 13 00 64 48 83
```


Any idea about how to continue to process this crash? Thank you.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.