Hi all,
i probably have found a bug in nfdump 1.6.12 with nsel enabled on
Solaris 11/Sparc. My Netflow exporter is ASA 9.2
The binary was built with 'oracle provided' gcc4.5.2 and
'--enable-nsel'. nfcapd runs fine, but 'nfdump -r' cores with bus error
after few lines of output. (nfdump -v, nfdump -x nsel enabled will
successfully verify gathered data file ).
Binary compiled without nsel extension will consume all input files
without error.
* Versions used:
`which gcc` --version
gcc (GCC) 4.5.2 (from Oracle Solaris 11 repository)
`which gmake` --version
GNU Make 3.82
`which as` -V
/usr/bin/as: Sun Compiler Common 12 SunOS_sparc s11_1sru13_04 10/22/2013
/var/tmp/nfcapd.201408211345 , gathered with nfcapd with nsel extension.
* Compile without O2 optimization and with enable-nsel
/var/tmp/nfdump-1.6.12
# -O2 optimisation removed, cast-align warnings added
export CFLAGS="-g -Wall -Wcast-align -Wstrict-prototypes
-Wmissing-prototypes -Wmissing-declarations -Wmissing-noreturn
-fno-strict-aliasing -DNSEL"
./configure --enable-nsel
gmake clean; gmake
* Gathered data with nfcapd `./bin/nfcapd -w -t 300 -D -T all -n
asa-fw,10.0.19.131,/var/nflogdata -p 9995 -b 10.0.14.17 -S 1`
* Test against previously gathered data
./bin/nfdump -r /var/tmp/nfcapd.201408211345
dumps with bus error
truss ./bin/nfdump -r /var/tmp/nfcapd.201408211345 2>&1|tail -5
close(4) = 0
Incurred fault #5, FLTACCESS %pc = 0x000170F4
siginfo: SIGBUS BUS_ADRALN addr=0x0012475C
Received signal #10, SIGBUS [default]
siginfo: SIGBUS BUS_ADRALN addr=0x0012475C
gdb --eval-command=run --args ./bin/nfdump -r /var/tmp/nfcapd.201408211345
yields:
Some successfully parsed and formatted output lines, then:
Program received signal SIGSEGV, Segmentation fault.
0x000170f4 in ExpandRecord_v2 (input_record=0x124710,
extension_info=0x112498, exporter_info=0x110cd0,
output_record=0x1124a8) at nffile_inline.c:363
363 output_record->event_time =
tpl->event_time;
The 'SIGSEGV' message might be misleading, see truss output above for
FLTACCESS fault suggesting a misaligned memory access.
fault.h
#define FLTACCESS 5 /* Memory access (e.g., alignment) */
I may provide an example of collected data if needed.
Do you have an idea how I can fix this problem?
thanks,
Sergej
------------------------------------------------------------------------------
Slashdot TV.
Video for Nerds. Stuff that matters.
http://tv.slashdot.org/
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
