Re: Sysmon dying
Jared Mauch <jared-li9M/[email protected]> Thu, 31 Mar 2011 09:30:47 -0400
| Newsgroups | gmane.comp.monitoring.sysmon.help |
|---|---|
| Message-ID | <[email protected]> |
--===============0476293074== Content-Type: multipart/alternative; boundary=Apple-Mail-1--998976698 Content-Transfer-Encoding: 7bit --Apple-Mail-1--998976698 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Can you gdb it and send the output of "where" to me? Jared Mauch On Mar 31, 2011, at 7:29 AM, Richard van Katwijk <[email protected]> wr= ote: > Hi, has anyone seen this before, or any idea what might cause it?=20 >=20 > My sysmon instance has been up and running for about a year, this is the s= econd time i am seeing this, though today it happens almost as soon as i res= tart. >=20 > Box is running Ubuntu 10.04 LTS and nothing has changed on that box in age= s. >=20 > Richard >=20 > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D >=20 > sysmond: 13:24:01 Starting sysmon v0.92.2 > *** stack smashing detected ***: /usr/local/bin/sysmond terminated > =3D=3D=3D=3D=3D=3D=3D Backtrace: =3D=3D=3D=3D=3D=3D=3D=3D=3D > /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x50)[0xb775d390] > /lib/tls/i686/cmov/libc.so.6(+0xe233a)[0xb775d33a] > /usr/local/bin/sysmond[0x8062086] > /usr/local/bin/sysmond[0x804ba4d] > /usr/local/bin/sysmond[0x804bf15] > /usr/local/bin/sysmond[0x804ca8d] > /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb7691bd6] > /usr/local/bin/sysmond[0x8049a71] > =3D=3D=3D=3D=3D=3D=3D Memory map: =3D=3D=3D=3D=3D=3D=3D=3D > 08048000-0806c000 r-xp 00000000 08:01 151 /usr/local/bin/sysmond > 0806c000-0806d000 r--p 00023000 08:01 151 /usr/local/bin/sysmond > 0806d000-0806e000 rw-p 00024000 08:01 151 /usr/local/bin/sysmond > 0806e000-08073000 rw-p 00000000 00:00 0 > 08900000-08940000 rw-p 00000000 00:00 0 [heap] > b7641000-b765e000 r-xp 00000000 08:01 478 /lib/libgcc_s.so.1 > b765e000-b765f000 r--p 0001c000 08:01 478 /lib/libgcc_s.so.1 > b765f000-b7660000 rw-p 0001d000 08:01 478 /lib/libgcc_s.so.1 > b7660000-b7664000 r-xp 00000000 08:01 8150 /lib/tls/i686/cmov/libnss= _dns-2.11.1.so > b7664000-b7665000 r--p 00004000 08:01 8150 /lib/tls/i686/cmov/libnss= _dns-2.11.1.so > b7665000-b7666000 rw-p 00005000 08:01 8150 /lib/tls/i686/cmov/libnss= _dns-2.11.1.so > b766e000-b7678000 r-xp 00000000 08:01 8151 /lib/tls/i686/cmov/libnss= _files-2.11.1.so > b7678000-b7679000 r--p 00009000 08:01 8151 /lib/tls/i686/cmov/libnss= _files-2.11.1.so > b7679000-b767a000 rw-p 0000a000 08:01 8151 /lib/tls/i686/cmov/libnss= _files-2.11.1.so > b767a000-b767b000 rw-p 00000000 00:00 0 > b767b000-b77ce000 r-xp 00000000 08:01 8138 /lib/tls/i686/cmov/libc-2= .11.1.so > b77ce000-b77cf000 ---p 00153000 08:01 8138 /lib/tls/i686/cmov/libc-2= .11.1.so > b77cf000-b77d1000 r--p 00153000 08:01 8138 /lib/tls/i686/cmov/libc-2= .11.1.so > b77d1000-b77d2000 rw-p 00155000 08:01 8138 /lib/tls/i686/cmov/libc-2= .11.1.so > b77d2000-b77d5000 rw-p 00000000 00:00 0 > b77d5000-b77e8000 r-xp 00000000 08:01 8148 /lib/tls/i686/cmov/libnsl= -2.11.1.so > b77e8000-b77e9000 r--p 00012000 08:01 8148 /lib/tls/i686/cmov/libnsl= -2.11.1.so > b77e9000-b77ea000 rw-p 00013000 08:01 8148 /lib/tls/i686/cmov/libnsl= -2.11.1.so > b77ea000-b77ed000 rw-p 00000000 00:00 0 > b77ed000-b7802000 r-xp 00000000 08:01 8157 /lib/tls/i686/cmov/libpth= read-2.11.1.so > b7802000-b7803000 r--p 00014000 08:01 8157 /lib/tls/i686/cmov/libpth= read-2.11.1.so > b7803000-b7804000 rw-p 00015000 08:01 8157 /lib/tls/i686/cmov/libpth= read-2.11.1.so > b7804000-b7806000 rw-p 00000000 00:00 0 > b7806000-b7816000 r-xp 00000000 08:01 8158 /lib/tls/i686/cmov/libres= olv-2.11.1.so > b7816000-b7817000 r--p 00010000 08:01 8158 /lib/tls/i686/cmov/libres= olv-2.11.1.so > b7817000-b7818000 rw-p 00011000 08:01 8158 /lib/tls/i686/cmov/libres= olv-2.11.1.so > b7818000-b781a000 rw-p 00000000 00:00 0 > b7821000-b7824000 rw-p 00000000 00:00 0 > b7824000-b7825000 r-xp 00000000 00:00 0 [vdso] > b7825000-b7840000 r-xp 00000000 08:01 636 /lib/ld-2.11.1.so > b7840000-b7841000 r--p 0001a000 08:01 636 /lib/ld-2.11.1.so > b7841000-b7842000 rw-p 0001b000 08:01 636 /lib/ld-2.11.1.so > bf86e000-bf883000 rw-p 00000000 00:00 0 [stack] > sysmond: 13:24:23 about to abort and dump core (i think in /root) >=20 > _______________________________________________ > Sysmon-help mailing list > Sysmon-help-li9M/[email protected] > https://puck.nether.net/mailman/listinfo/sysmon-help --Apple-Mail-1--998976698 Content-Transfer-Encoding: 7bit Content-Type: text/html; charset=utf-8 <html><body bgcolor="#FFFFFF"><div>Can you gdb it and send the output of "where" to me?<br><br>Jared Mauch</div><div><br>On Mar 31, 2011, at 7:29 AM, Richard van Katwijk <<a href="mailto:[email protected]">[email protected]</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>Hi, has anyone seen this before, or any idea what might cause it? <br><br>My sysmon instance has been up and running for about a year, this is the second time i am seeing this, though today it happens almost as soon as i restart.<br> <br>Box is running Ubuntu 10.04 LTS and nothing has changed on that box in ages.<br><br clear="all"><span style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"><span style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"><span style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: norm al; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"><div> <div><font face="Verdana">Richard</font></div></div></span></span></span><div class="gmail_quote"><br>================================================================<br><br>sysmond: 13:24:01 Starting sysmon v0.92.2<br> <div>*** stack smashing detected ***: /usr/local/bin/sysmond terminated<br> ======= Backtrace: =========<br> </div>/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x50)[0xb775d390]<br> /lib/tls/i686/cmov/libc.so.6(+0xe233a)[0xb775d33a]<br> <div>/usr/local/bin/sysmond[0x8062086]<br> /usr/local/bin/sysmond[0x804ba4d]<br> /usr/local/bin/sysmond[0x804bf15]<br> /usr/local/bin/sysmond[0x804ca8d]<br> </div>/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb7691bd6]<br> <div>/usr/local/bin/sysmond[0x8049a71]<br> ======= Memory map: ========<br> 08048000-0806c000 r-xp 00000000 08:01 151 /usr/local/bin/sysmond<br> 0806c000-0806d000 r--p 00023000 08:01 151 /usr/local/bin/sysmond<br> 0806d000-0806e000 rw-p 00024000 08:01 151 /usr/local/bin/sysmond<br> 0806e000-08073000 rw-p 00000000 00:00 0<br> </div>08900000-08940000 rw-p 00000000 00:00 0 [heap]<br> b7641000-b765e000 r-xp 00000000 08:01 478 /lib/libgcc_s.so.1<br> b765e000-b765f000 r--p 0001c000 08:01 478 /lib/libgcc_s.so.1<br> b765f000-b7660000 rw-p 0001d000 08:01 478 /lib/libgcc_s.so.1<br> b7660000-b7664000 r-xp 00000000 08:01 8150 /lib/tls/i686/cmov/<a href="http://libnss_dns-2.11.1.so" target="_blank">libnss_dns-2.11.1.so</a><br> b7664000-b7665000 r--p 00004000 08:01 8150 /lib/tls/i686/cmov/<a href="http://libnss_dns-2.11.1.so" target="_blank">libnss_dns-2.11.1.so</a><br> b7665000-b7666000 rw-p 00005000 08:01 8150 /lib/tls/i686/cmov/<a href="http://libnss_dns-2.11.1.so" target="_blank">libnss_dns-2.11.1.so</a><br> b766e000-b7678000 r-xp 00000000 08:01 8151 /lib/tls/i686/cmov/<a href="http://libnss_files-2.11.1.so" target="_blank">libnss_files-2.11.1.so</a><br> b7678000-b7679000 r--p 00009000 08:01 8151 /lib/tls/i686/cmov/<a href="http://libnss_files-2.11.1.so" target="_blank">libnss_files-2.11.1.so</a><br> b7679000-b767a000 rw-p 0000a000 08:01 8151 /lib/tls/i686/cmov/<a href="http://libnss_files-2.11.1.so" target="_blank">libnss_files-2.11.1.so</a><br> b767a000-b767b000 rw-p 00000000 00:00 0<br> b767b000-b77ce000 r-xp 00000000 08:01 8138 /lib/tls/i686/cmov/<a href="http://libc-2.11.1.so" target="_blank">libc-2.11.1.so</a><br> b77ce000-b77cf000 ---p 00153000 08:01 8138 /lib/tls/i686/cmov/<a href="http://libc-2.11.1.so" target="_blank">libc-2.11.1.so</a><br> b77cf000-b77d1000 r--p 00153000 08:01 8138 /lib/tls/i686/cmov/<a href="http://libc-2.11.1.so" target="_blank">libc-2.11.1.so</a><br> b77d1000-b77d2000 rw-p 00155000 08:01 8138 /lib/tls/i686/cmov/<a href="http://libc-2.11.1.so" target="_blank">libc-2.11.1.so</a><br> b77d2000-b77d5000 rw-p 00000000 00:00 0<br> b77d5000-b77e8000 r-xp 00000000 08:01 8148 /lib/tls/i686/cmov/<a href="http://libnsl-2.11.1.so" target="_blank">libnsl-2.11.1.so</a><br> b77e8000-b77e9000 r--p 00012000 08:01 8148 /lib/tls/i686/cmov/<a href="http://libnsl-2.11.1.so" target="_blank">libnsl-2.11.1.so</a><br> b77e9000-b77ea000 rw-p 00013000 08:01 8148 /lib/tls/i686/cmov/<a href="http://libnsl-2.11.1.so" target="_blank">libnsl-2.11.1.so</a><br> b77ea000-b77ed000 rw-p 00000000 00:00 0<br> b77ed000-b7802000 r-xp 00000000 08:01 8157 /lib/tls/i686/cmov/<a href="http://libpthread-2.11.1.so" target="_blank">libpthread-2.11.1.so</a><br> b7802000-b7803000 r--p 00014000 08:01 8157 /lib/tls/i686/cmov/<a href="http://libpthread-2.11.1.so" target="_blank">libpthread-2.11.1.so</a><br> b7803000-b7804000 rw-p 00015000 08:01 8157 /lib/tls/i686/cmov/<a href="http://libpthread-2.11.1.so" target="_blank">libpthread-2.11.1.so</a><br> b7804000-b7806000 rw-p 00000000 00:00 0<br> b7806000-b7816000 r-xp 00000000 08:01 8158 /lib/tls/i686/cmov/<a href="http://libresolv-2.11.1.so" target="_blank">libresolv-2.11.1.so</a><br> b7816000-b7817000 r--p 00010000 08:01 8158 /lib/tls/i686/cmov/<a href="http://libresolv-2.11.1.so" target="_blank">libresolv-2.11.1.so</a><br> b7817000-b7818000 rw-p 00011000 08:01 8158 /lib/tls/i686/cmov/<a href="http://libresolv-2.11.1.so" target="_blank">libresolv-2.11.1.so</a><br> b7818000-b781a000 rw-p 00000000 00:00 0<br> b7821000-b7824000 rw-p 00000000 00:00 0<br> b7824000-b7825000 r-xp 00000000 00:00 0 [vdso]<br> b7825000-b7840000 r-xp 00000000 08:01 636 /lib/<a href="http://ld-2.11.1.so" target="_blank">ld-2.11.1.so</a><br> b7840000-b7841000 r--p 0001a000 08:01 636 /lib/<a href="http://ld-2.11.1.so" target="_blank">ld-2.11.1.so</a><br> b7841000-b7842000 rw-p 0001b000 08:01 636 /lib/<a href="http://ld-2.11.1.so" target="_blank">ld-2.11.1.so</a><br> bf86e000-bf883000 rw-p 00000000 00:00 0 [stack]<br> sysmond: 13:24:23 about to abort and dump core (i think in /root)<br> </div><br> </div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Sysmon-help mailing list</span><br><span><a href="mailto:Sysmon-help-li9M/[email protected]">Sysmon-help-li9M/[email protected]</a></span><br><span><a href="https://puck.nether.net/mailman/listinfo/sysmon-help">https://puck.nether.net/mailman/listinfo/sysmon-help</a></span><br></div></blockquote></body></html> --Apple-Mail-1--998976698-- --===============0476293074== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sysmon-help mailing list Sysmon-help-li9M/[email protected] https://puck.nether.net/mailman/listinfo/sysmon-help --===============0476293074==--