netfilter buglog - Feb 2011 - [Bug 673] ULOGD stack with MySQL not loading

http://bugzilla.netfilter.org/show_bug.cgi?id=673





--- Comment #16 from Pablo Neira Ayuso <pablo at netfilter.org> 
2011-02-27 20:42:54 ---
Have been this issue finally resolved? Please close the bug if so. We're bug
hunting to reach final first ulogd 2.0 release. Thanks!


-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

http://bugzilla.netfilter.org/show_bug.cgi?id=673





--- Comment #17 from gemneye <netfilter at gemneye.org>  2011-02-27
21:31:01 ---
(In reply to comment #16)
> Have been this issue finally resolved? Please close the bug if so.
We're bug
> hunting to reach final first ulogd 2.0 release. Thanks!
> 
With the old code mentioned in this thread this problem was never resolved.  I
am unable to compile latest SVN code due to dependencies (not having newer
development tools).


-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

http://bugzilla.netfilter.org/show_bug.cgi?id=673





--- Comment #18 from Eric Leblond <eric at inl.fr>  2011-03-01 20:34:47
---
(In reply to comment #17)
> (In reply to comment #16)
> > Have been this issue finally resolved? Please close the bug if so.
We're bug
> > hunting to reach final first ulogd 2.0 release. Thanks!
> > 
> 
> With the old code mentioned in this thread this problem was never resolved.
I
> am unable to compile latest SVN code due to dependencies (not having newer
> development tools).
> 
Too bad.

I've try almost all possibilities I was able to think of, but I'm not
able to
reproduce the bug on my system. Given the backtrace, this is a bug in HWHDR
plugin. It seems, your system is issuing something strange because the MAC is :
   MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00
and this is strange for a packet coming from eth2.

Which kernel are you using ?


-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

http://bugzilla.netfilter.org/show_bug.cgi?id=673





--- Comment #19 from gemneye <netfilter at gemneye.org>  2011-03-02
06:45:27 ---
(In reply to comment #18)
> (In reply to comment #17)
> > (In reply to comment #16)
> > > Have been this issue finally resolved? Please close the bug if
so. We're bug
> > > hunting to reach final first ulogd 2.0 release. Thanks!
> > > 
> > 
> > With the old code mentioned in this thread this problem was never
resolved.  I
> > am unable to compile latest SVN code due to dependencies (not having
newer
> > development tools).
> > 
> 
> Too bad.
> 
> I've try almost all possibilities I was able to think of, but I'm
not able to
> reproduce the bug on my system. Given the backtrace, this is a bug in HWHDR
> plugin. It seems, your system is issuing something strange because the MAC
is :
>    MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00
> and this is strange for a packet coming from eth2.
> 
> Which kernel are you using ?
> 
I am using a vendor supplied kernel CentOS 5.5
2.6.18-194.32.1.el5.centos.plus


-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

http://bugzilla.netfilter.org/show_bug.cgi?id=673





--- Comment #20 from gemneye <netfilter at gemneye.org>  2011-03-02
07:11:20 ---
(In reply to comment #18)
> (In reply to comment #17)
> > (In reply to comment #16)
> > > Have been this issue finally resolved? Please close the bug if
so. We're bug
> > > hunting to reach final first ulogd 2.0 release. Thanks!
> > > 
> > 
> > With the old code mentioned in this thread this problem was never
resolved.  I
> > am unable to compile latest SVN code due to dependencies (not having
newer
> > development tools).
> > 
> 
> Too bad.
> 
> I've try almost all possibilities I was able to think of, but I'm
not able to
> reproduce the bug on my system. Given the backtrace, this is a bug in HWHDR
> plugin. It seems, your system is issuing something strange because the MAC
is :
>    MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00
> and this is strange for a packet coming from eth2.
> 
> Which kernel are you using ?
> 
It has been some time since I looked at this, but I may have changed the
MADADDRs to protect the innocent.

I tried again compiling the ulogd2 code from 2010-09-24 and am getting the same
errors:

Mar  1 22:59:24 firewall kernel: ulogd[27612]: segfault at 0000000000000030 rip
00002b9acd04ab5b rsp 00007ffffab627e0 error 4
Mar  1 23:02:39 firewall kernel: ulogd[27808]: segfault at 0000000000000008 rip
0000000000403ef2 rsp 00007fffa3fb4258 error 6

I believe this is the original source code (without patch from this thread)
from the date listed above.

So any updates to the kernel which may have been made since 2010-09-24 is not
making any differences to the results with ulogd2.

Enabling only the single stack which logs to a file seems to work.  It is when
the logging to MySQL stack is enabled when problems arise.

Thanks.


-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

http://bugzilla.netfilter.org/show_bug.cgi?id=673





--- Comment #21 from Jan Engelhardt <jengelh at medozas.de>  2011-03-02
13:21:58 ---
Sounds like a round of valgrind is in order.


-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

http://bugzilla.netfilter.org/show_bug.cgi?id=673





--- Comment #22 from Pablo Neira Ayuso <pablo at netfilter.org> 
2011-03-10 11:26:38 ---
(In reply to comment #21)
> Sounds like a round of valgrind is in order.
Indeed. Please, run ulogd over valgrind and post the segfault trace.


-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.