rsyslog dies with segmentation fault when using the "imfile" module

Solution Verified - Updated -

Issue

  • When using the imfile module, rsyslog dies with the following error message, usually after a log rotation occurred

    [...] kernel: traps: in:imfile[XXX] general protection ip:55cf698e7325 sp:7fc1d77fa8a8 error:0 in rsyslogd[55cf698c7000+95000]
    

    Addresses specified in ip, sp and rsyslogd may vary.

  • The core_backtrace file in the corresponding abrt report (assuming abrt is installed on the system) looks similar to the following lines (cleaned excerpts)

    {   "signal": 11
    ,   "executable": "/usr/sbin/rsyslogd"
    ,   "stacktrace":
          [ {   "crash_thread": true
            ,   "frames":
                  [ {   ...
                    ,   "function_name": "getMSGLen"
                    ,   "file_name": "/usr/sbin/rsyslogd"
                    }
                  , {   ...
                    ,   "function_name": "ratelimitMsg"
                    ,   "file_name": "/usr/sbin/rsyslogd"
                    }
                  , {   ...
                    ,   "function_name": "ratelimitAddMsg"
                    ,   "file_name": "/usr/sbin/rsyslogd"
                    }
                  , {   ...
                    ,   "function_name": "pollFile"
                    ,   "file_name": "/usr/lib64/rsyslog/imfile.so"
                    }
                  , {   ...
                    ,   "function_name": "act_obj_destroy"
                    ,   "file_name": "/usr/lib64/rsyslog/imfile.so"
                    }
    ...
    

Environment

  • Red Hat Enterprise Linux 7

    • rsyslog-8.24.0, version lower than rsyslog-8.24.0-41.el7_7.2
  • Red Hat Enterprise Linux 8

    • rsyslog-8.37.0

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content