Possible race condition/uninitialized buffer when logging duplicated messages to ommysql
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
rsyslog (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
I'm running rsyslog with the ommysql plugin. The configuration file is as follows (unimportant details omited):
$ModLoad ommysql
$template custom_
:programname, !startswith, "mysqld" :ommysql:
That works in normal conditions. However, when under heavy load, rsyslog sometimes fails with "db error (1064): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near...". I've patched rsyslog and was able to get a sample of the offending query being generated:
INSERT INTO events (message, facility, from_host, priority, device_
'%HOSTNAME%' is being replaced by '\', which clearly makes the query invalid.
A sample of other queries shows that maybe a race condition is causing uninitialized data to be sent to the ommysql plugin:
INSERT INTO events (message, facility, from_host, priority, device_
INSERT INTO events (message, facility, from_host, priority, device_
INSERT INTO events (message, facility, from_host, priority, device_
I assume it's something internal to the ommysql plugin, because the same messages are also being sent to /var/log/syslog and that trash does not appear there:
Jul 15 14:20:48 arachni[4509]: last message repeated 2 times
Jul 15 14:17:00 arachni[4509]: last message repeated 10 times
Jul 15 14:18:08 arachni[3965]: last message repeated 2 times
Jul 15 14:18:23 httpd-access[6394]: last message repeated 2 times
Software version information:
$ lsb_release -rd
Description: Ubuntu 12.04.2 LTS
Release: 12.04
$ apt-cache policy rsyslog
rsyslog:
Installed: 5.8.6-1ubuntu8.4
Candidate: 5.8.6-1ubuntu8.4
Version table:
*** 5.8.6-1ubuntu8.4 0
500 http://
100 /var/lib/
500 http://
summary: |
Possible race condition/uninitialized buffer when logging duplicated - messages + messages to ommysql |
As also suggested in another bug report, using Adiscon repositories fixes the issue: http:// www.rsyslog. com/ubuntu- repository/