rsyslogd terminates abnormally when certain files are specified as 'InputFile'.
Issue
- In an operation of InputFile by imfile.so of rsyslog, rsyslogd terminated abnormally.
-
Also, following messages appeared when it occurred.
-
Excerpt from messages in sosreport
Mar 16 18:35:45 server01 rsyslogd: [origin software="rsyslogd" swVersion="4.6.2" x-pid="4590" x-info="http://www.rsyslog.com"] (re)start
*** glibc detected *** /sbin/rsyslogd: realloc(): invalid next size: 0x00007fd3f02e7090 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x3db2e75e66)[0x7fd4015f1e66]
/lib64/libc.so.6(+0x3db2e7b937)[0x7fd4015f7937]
/lib64/libc.so.6(realloc+0xe5)[0x7fd4015f7af5]
/sbin/rsyslogd(rsCStrExtendBuf+0x32)[0x7fd4025a4c52]
/sbin/rsyslogd(+0x29385)[0x7fd4025b0385]
/lib64/rsyslog/imfile.so(+0x169a)[0x7fd40095469a]
/sbin/rsyslogd(+0x3636e)[0x7fd4025bd36e]
/lib64/libpthread.so.0(+0x3db36079d1)[0x7fd401f399d1]
/lib64/libc.so.6(clone+0x6d)[0x7fd4016648fd]
======= Memory map: ========
7fd3e8000000-7fd3e8021000 rw-p 00000000 00:00 0
7fd3e8021000-7fd3ec000000 ---p 00000000 00:00 0
- Excerpt from rsyslog.conf
::
$ModLoad imfile.so
::
$InputFileName /var/aasysman/logs/mon/webview-app.log
$InputFileTag webvwapp:
$InputFileStateFile webvwapp-stat-mon
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
::
$InputFileName /var/aasysman/logs/mon/webapi-com.log
$InputFileTag webapicom:
$InputFileStateFile webapicom-stat-mon
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
::
if $programname contains 'webvwcom' then @172.XXX.XXX.XXX:514
if $programname contains 'webvwcom' then ~
if $programname contains 'webvwapp' then @172.XXX.XXX.XXX:514
if $programname contains 'webvwapp' then ~
Environment
- Red Hat Enterprise Linux 6.2
- rsyslog-4.6.2-12.el6.x86_64
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.