Hi

I have 8 rhel 5.7 servers where snmpd segfaults once a week.

It might be caused by a combination of my custzomizations and /etc/logrotate.d/snmpd

Errors look like this:

snmpd[21870]: segfault at 0000000000010202 rip 0000000000010202 rsp 00007fffe9f0f568 error 14
snmpd[31982]: segfault at 00002aaaae730d67 rip 00002aaaae730d67 rsp 00007fffc374dbe8 error 14
snmpd[1461]: segfault at 0000000000010202 rip 0000000000010202 rsp 00007fff67b5f798 error 14

I made some customizations to the snmp configuration because I did not want snmpd to flood /var/log/messages.

I changed the snmpd configuration to log to the local6 facility.

# cat /etc/sysconfig/snmpd.options

# snmpd command line options
# OPTIONS="-Lsd -Lf /dev/null -p /var/run/snmpd.pid -a"
# log to syslog local6 faciltiy, see /etc/syslog.conf
OPTIONS="-Ls6 -Lf /dev/null -p /var/run/snmpd.pid -a"

And I redirect snmp messages to /var/log/snmpd.log

# grep local6 /etc/syslog.conf

*.info;mail.none;news.none;authpriv.none;cron.none;local6.none          /var/log/messages

local6.*                                                                                             /var/log/snmpd.log

Versions:

# rpm -q net-snmp
net-snmp-5.3.2.2-14.el5_7.1

# rpm -qf /etc/logrotate.d/snmpd
net-snmp-5.3.2.2-14.el5_7.1

Logrotate:

# cat /etc/logrotate.d/snmpd

/var/log/snmpd.log {
    notifempty
    missingok
    postrotate
            /bin/kill -HUP `cat /var/run/snmpd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

/etc/logrotate.d/snmpd seams to be configured for snmpd native logging (without syslog).

I think the postrotate with syslog should be like this:

        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true

Anyway if I run

/bin/kill -HUP `cat /var/run/snmpd.pid 2> /dev/null` 2> /dev/null || true

manually, snmpd segfaults.

I changed /etc/logrotate.d/snmpd to:

/var/log/snmpd.log {
    notifempty
    missingok
    postrotate
        if /bin/grep -v '^#' /var/log/snmpd.log | /bin/grep /etc/syslog.conf > /dev/null
        then
            /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        else
            /bin/kill -HUP `cat /var/run/snmpd.pid 2> /dev/null` 2> /dev/null || true
        fi
    endscript
}
 

Can anyone confirm the segfault?

Should /etc/logrotate.d/snmpd be changed as described?

Regards

Kolja von Sawilski