Re: Sysmon dying

--===============1624515076==
Content-Type: multipart/alternative; boundary=0016e6db295ab33ae0049fc8d22f

--0016e6db295ab33ae0049fc8d22f
Content-Type: text/plain; charset=ISO-8859-1

Hi Jared,

I am not too familiar with gdb, do i need to run it as gbd sysmond or attach
gdb to the process id? Neither seem to give anything useful.

On 31 March 2011 15:30, Jared Mauch <jared-li9M/[email protected]> wrote:

> Can you gdb it and send the output of "where" to me?
>
> Jared Mauch
>
> On Mar 31, 2011, at 7:29 AM, Richard van Katwijk <[email protected]>
> wrote:
>
> Hi, has anyone seen this before, or any idea what might cause it?
>
> My sysmon instance has been up and running for about a year, this is the
> second time i am seeing this, though today it happens almost as soon as i
> restart.
>
> Box is running Ubuntu 10.04 LTS and nothing has changed on that box in
> ages.
>
> Richard
>
> ================================================================
>
> sysmond: 13:24:01 Starting sysmon v0.92.2
> *** stack smashing detected ***: /usr/local/bin/sysmond terminated
> ======= Backtrace: =========
> /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x50)[0xb775d390]
> /lib/tls/i686/cmov/libc.so.6(+0xe233a)[0xb775d33a]
> /usr/local/bin/sysmond[0x8062086]
> /usr/local/bin/sysmond[0x804ba4d]
> /usr/local/bin/sysmond[0x804bf15]
> /usr/local/bin/sysmond[0x804ca8d]
> /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb7691bd6]
> /usr/local/bin/sysmond[0x8049a71]
> ======= Memory map: ========
> 08048000-0806c000 r-xp 00000000 08:01 151        /usr/local/bin/sysmond
> 0806c000-0806d000 r--p 00023000 08:01 151        /usr/local/bin/sysmond
> 0806d000-0806e000 rw-p 00024000 08:01 151        /usr/local/bin/sysmond
> 0806e000-08073000 rw-p 00000000 00:00 0
> 08900000-08940000 rw-p 00000000 00:00 0          [heap]
> b7641000-b765e000 r-xp 00000000 08:01 478        /lib/libgcc_s.so.1
> b765e000-b765f000 r--p 0001c000 08:01 478        /lib/libgcc_s.so.1
> b765f000-b7660000 rw-p 0001d000 08:01 478        /lib/libgcc_s.so.1
> b7660000-b7664000 r-xp 00000000 08:01 8150       /lib/tls/i686/cmov/
> libnss_dns-2.11.1.so
> b7664000-b7665000 r--p 00004000 08:01 8150       /lib/tls/i686/cmov/
> libnss_dns-2.11.1.so
> b7665000-b7666000 rw-p 00005000 08:01 8150       /lib/tls/i686/cmov/
> libnss_dns-2.11.1.so
> b766e000-b7678000 r-xp 00000000 08:01 8151       /lib/tls/i686/cmov/
> libnss_files-2.11.1.so
> b7678000-b7679000 r--p 00009000 08:01 8151       /lib/tls/i686/cmov/
> libnss_files-2.11.1.so
> b7679000-b767a000 rw-p 0000a000 08:01 8151       /lib/tls/i686/cmov/
> libnss_files-2.11.1.so
> b767a000-b767b000 rw-p 00000000 00:00 0
> b767b000-b77ce000 r-xp 00000000 08:01 8138       /lib/tls/i686/cmov/
> libc-2.11.1.so
> b77ce000-b77cf000 ---p 00153000 08:01 8138       /lib/tls/i686/cmov/
> libc-2.11.1.so
> b77cf000-b77d1000 r--p 00153000 08:01 8138       /lib/tls/i686/cmov/
> libc-2.11.1.so
> b77d1000-b77d2000 rw-p 00155000 08:01 8138       /lib/tls/i686/cmov/
> libc-2.11.1.so
> b77d2000-b77d5000 rw-p 00000000 00:00 0
> b77d5000-b77e8000 r-xp 00000000 08:01 8148       /lib/tls/i686/cmov/
> libnsl-2.11.1.so
> b77e8000-b77e9000 r--p 00012000 08:01 8148       /lib/tls/i686/cmov/
> libnsl-2.11.1.so
> b77e9000-b77ea000 rw-p 00013000 08:01 8148       /lib/tls/i686/cmov/
> libnsl-2.11.1.so
> b77ea000-b77ed000 rw-p 00000000 00:00 0
> b77ed000-b7802000 r-xp 00000000 08:01 8157       /lib/tls/i686/cmov/
> libpthread-2.11.1.so
> b7802000-b7803000 r--p 00014000 08:01 8157       /lib/tls/i686/cmov/
> libpthread-2.11.1.so
> b7803000-b7804000 rw-p 00015000 08:01 8157       /lib/tls/i686/cmov/
> libpthread-2.11.1.so
> b7804000-b7806000 rw-p 00000000 00:00 0
> b7806000-b7816000 r-xp 00000000 08:01 8158       /lib/tls/i686/cmov/
> libresolv-2.11.1.so
> b7816000-b7817000 r--p 00010000 08:01 8158       /lib/tls/i686/cmov/
> libresolv-2.11.1.so
> b7817000-b7818000 rw-p 00011000 08:01 8158       /lib/tls/i686/cmov/
> libresolv-2.11.1.so
> b7818000-b781a000 rw-p 00000000 00:00 0
> b7821000-b7824000 rw-p 00000000 00:00 0
> b7824000-b7825000 r-xp 00000000 00:00 0          [vdso]
> b7825000-b7840000 r-xp 00000000 08:01 636        /lib/ld-2.11.1.so
> b7840000-b7841000 r--p 0001a000 08:01 636        /lib/ld-2.11.1.so
> b7841000-b7842000 rw-p 0001b000 08:01 636        /lib/ld-2.11.1.so
> bf86e000-bf883000 rw-p 00000000 00:00 0          [stack]
> sysmond: 13:24:23 about to abort and dump core (i think in /root)
>
> _______________________________________________
> Sysmon-help mailing list
> Sysmon-help-li9M/[email protected]
> https://puck.nether.net/mailman/listinfo/sysmon-help
>
>

--0016e6db295ab33ae0049fc8d22f
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi Jared,<br><br>I am not too familiar with gdb, do i need to run it as gbd=
 sysmond or attach gdb to the process id? Neither seem to give anything use=
ful.<br><br><div class=3D"gmail_quote">On 31 March 2011 15:30, Jared Mauch =
<span dir=3D"ltr">&lt;<a href=3D"mailto:jared-li9M/[email protected]">[email protected]=
ether.net</a>&gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0.8ex; borde=
r-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div bgcolor=3D"#=
FFFFFF"><div>Can you gdb it and send the output of &quot;where&quot; to me?=
<br>
<br>Jared Mauch</div><div><div></div><div class=3D"h5"><div><br>On Mar 31, =
2011, at 7:29 AM, Richard van Katwijk &lt;<a href=3D"mailto:richard@three6f=
ive.com" target=3D"_blank">[email protected]</a>&gt; wrote:<br><br></d=
iv>
<div></div><blockquote type=3D"cite"><div>Hi, has anyone seen this before, =
or any idea what might cause it? <br><br>My sysmon instance has been up and=
 running for about a year, this is the second time i am seeing this, though=
 today it happens almost as soon as i restart.<br>

<br>Box is running Ubuntu 10.04 LTS and nothing has changed on that box in =
ages.<br><br clear=3D"all"><span style=3D"border-collapse: separate; color:=
 rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal;=
 font-variant: normal; font-weight: normal; letter-spacing: normal; line-he=
ight: normal; text-indent: 0px; text-transform: none; white-space: normal; =
word-spacing: 0px;"><span style=3D"border-collapse: separate; color: rgb(0,=
 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-v=
ariant: normal; font-weight: normal; letter-spacing: normal; line-height: n=
ormal; text-indent: 0px; text-transform: none; white-space: normal; word-sp=
acing: 0px;"><span style=3D"border-collapse: separate; color: rgb(0, 0, 0);=
 font-family: Helvetica; font-size: 12px; font-style: normal; font-variant:=
 normal; font-weight: normal; letter-spacing: normal; line-height: normal; =
text-indent: 0px; text-transform: none; white-space: normal; word-spacing: =
0px;"><div>


<div><font face=3D"Verdana">Richard</font></div></div></span></span></span>=
<div class=3D"gmail_quote"><br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
<br><br>sysmond: 13:24:01 Starting sysmon v0.92.2<br>
<div>*** stack smashing detected ***: /usr/local/bin/sysmond terminated<br>
=3D=3D=3D=3D=3D=3D=3D Backtrace: =3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
</div>/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x50)[0xb775d390]<br>
/lib/tls/i686/cmov/libc.so.6(+0xe233a)[0xb775d33a]<br>
<div>/usr/local/bin/sysmond[0x8062086]<br>
/usr/local/bin/sysmond[0x804ba4d]<br>
/usr/local/bin/sysmond[0x804bf15]<br>
/usr/local/bin/sysmond[0x804ca8d]<br>
</div>/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb7691bd6]<br>
<div>/usr/local/bin/sysmond[0x8049a71]<br>
=3D=3D=3D=3D=3D=3D=3D Memory map: =3D=3D=3D=3D=3D=3D=3D=3D<br>
08048000-0806c000 r-xp 00000000 08:01 151 =A0 =A0 =A0 =A0/usr/local/bin/sys=
mond<br>
0806c000-0806d000 r--p 00023000 08:01 151 =A0 =A0 =A0 =A0/usr/local/bin/sys=
mond<br>
0806d000-0806e000 rw-p 00024000 08:01 151 =A0 =A0 =A0 =A0/usr/local/bin/sys=
mond<br>
0806e000-08073000 rw-p 00000000 00:00 0<br>
</div>08900000-08940000 rw-p 00000000 00:00 0 =A0 =A0 =A0 =A0 =A0[heap]<br>
b7641000-b765e000 r-xp 00000000 08:01 478 =A0 =A0 =A0 =A0/lib/libgcc_s.so.1=
<br>
b765e000-b765f000 r--p 0001c000 08:01 478 =A0 =A0 =A0 =A0/lib/libgcc_s.so.1=
<br>
b765f000-b7660000 rw-p 0001d000 08:01 478 =A0 =A0 =A0 =A0/lib/libgcc_s.so.1=
<br>
b7660000-b7664000 r-xp 00000000 08:01 8150 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libnss_dns-2.11.1.so" target=3D"_blank">libnss_dns-2.11.1.=
so</a><br>
b7664000-b7665000 r--p 00004000 08:01 8150 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libnss_dns-2.11.1.so" target=3D"_blank">libnss_dns-2.11.1.=
so</a><br>
b7665000-b7666000 rw-p 00005000 08:01 8150 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libnss_dns-2.11.1.so" target=3D"_blank">libnss_dns-2.11.1.=
so</a><br>
b766e000-b7678000 r-xp 00000000 08:01 8151 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libnss_files-2.11.1.so" target=3D"_blank">libnss_files-2.1=
1.1.so</a><br>
b7678000-b7679000 r--p 00009000 08:01 8151 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libnss_files-2.11.1.so" target=3D"_blank">libnss_files-2.1=
1.1.so</a><br>
b7679000-b767a000 rw-p 0000a000 08:01 8151 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libnss_files-2.11.1.so" target=3D"_blank">libnss_files-2.1=
1.1.so</a><br>
b767a000-b767b000 rw-p 00000000 00:00 0<br>
b767b000-b77ce000 r-xp 00000000 08:01 8138 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.1.so</a><br>
b77ce000-b77cf000 ---p 00153000 08:01 8138 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.1.so</a><br>
b77cf000-b77d1000 r--p 00153000 08:01 8138 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.1.so</a><br>
b77d1000-b77d2000 rw-p 00155000 08:01 8138 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.1.so</a><br>
b77d2000-b77d5000 rw-p 00000000 00:00 0<br>
b77d5000-b77e8000 r-xp 00000000 08:01 8148 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libnsl-2.11.1.so" target=3D"_blank">libnsl-2.11.1.so</a><b=
r>
b77e8000-b77e9000 r--p 00012000 08:01 8148 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libnsl-2.11.1.so" target=3D"_blank">libnsl-2.11.1.so</a><b=
r>
b77e9000-b77ea000 rw-p 00013000 08:01 8148 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libnsl-2.11.1.so" target=3D"_blank">libnsl-2.11.1.so</a><b=
r>
b77ea000-b77ed000 rw-p 00000000 00:00 0<br>
b77ed000-b7802000 r-xp 00000000 08:01 8157 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libpthread-2.11.1.so" target=3D"_blank">libpthread-2.11.1.=
so</a><br>
b7802000-b7803000 r--p 00014000 08:01 8157 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libpthread-2.11.1.so" target=3D"_blank">libpthread-2.11.1.=
so</a><br>
b7803000-b7804000 rw-p 00015000 08:01 8157 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libpthread-2.11.1.so" target=3D"_blank">libpthread-2.11.1.=
so</a><br>
b7804000-b7806000 rw-p 00000000 00:00 0<br>
b7806000-b7816000 r-xp 00000000 08:01 8158 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libresolv-2.11.1.so" target=3D"_blank">libresolv-2.11.1.so=
</a><br>
b7816000-b7817000 r--p 00010000 08:01 8158 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libresolv-2.11.1.so" target=3D"_blank">libresolv-2.11.1.so=
</a><br>
b7817000-b7818000 rw-p 00011000 08:01 8158 =A0 =A0 =A0 /lib/tls/i686/cmov/<=
a href=3D"http://libresolv-2.11.1.so" target=3D"_blank">libresolv-2.11.1.so=
</a><br>
b7818000-b781a000 rw-p 00000000 00:00 0<br>
b7821000-b7824000 rw-p 00000000 00:00 0<br>
b7824000-b7825000 r-xp 00000000 00:00 0 =A0 =A0 =A0 =A0 =A0[vdso]<br>
b7825000-b7840000 r-xp 00000000 08:01 636 =A0 =A0 =A0 =A0/lib/<a href=3D"ht=
tp://ld-2.11.1.so" target=3D"_blank">ld-2.11.1.so</a><br>
b7840000-b7841000 r--p 0001a000 08:01 636 =A0 =A0 =A0 =A0/lib/<a href=3D"ht=
tp://ld-2.11.1.so" target=3D"_blank">ld-2.11.1.so</a><br>
b7841000-b7842000 rw-p 0001b000 08:01 636 =A0 =A0 =A0 =A0/lib/<a href=3D"ht=
tp://ld-2.11.1.so" target=3D"_blank">ld-2.11.1.so</a><br>
bf86e000-bf883000 rw-p 00000000 00:00 0 =A0 =A0 =A0 =A0 =A0[stack]<br>
sysmond: 13:24:23 about to abort and dump core (i think in /root)<br>
</div><br>
</div></blockquote></div></div><blockquote type=3D"cite"><div><span>_______=
________________________________________</span><br><span>Sysmon-help mailin=
g list</span><br><span><a href=3D"mailto:Sysmon-help-li9M/[email protected]" targe=
t=3D"_blank">Sysmon-help-li9M/[email protected]</a></span><br>
<span><a href=3D"https://puck.nether.net/mailman/listinfo/sysmon-help" targ=
et=3D"_blank">https://puck.nether.net/mailman/listinfo/sysmon-help</a></spa=
n><br></div></blockquote></div></blockquote></div><br>

--0016e6db295ab33ae0049fc8d22f--

--===============1624515076==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Sysmon-help mailing list
Sysmon-help-li9M/[email protected]
https://puck.nether.net/mailman/listinfo/sysmon-help

--===============1624515076==--