Re: Sysmon dying
Richard van Katwijk <[email protected]> Thu, 31 Mar 2011 23:33:51 +0200
| Newsgroups | gmane.comp.monitoring.sysmon.help |
|---|---|
| Message-ID | <[email protected]> |
--===============0116993567== Content-Type: multipart/alternative; boundary=000e0cd5197cab164d049fce0cdf --000e0cd5197cab164d049fce0cdf Content-Type: text/plain; charset=ISO-8859-1 This article contains some detail on when a core file may not be produced: http://manpages.ubuntu.com/manpages/intrepid/man5/core.5.html I have been through each, and none should be the cause in my case. I have now started sysmon as root (the usual) in /tmp - lets see what it does..... On 31 March 2011 23:08, Richard van Katwijk <[email protected]> wrote: > :( > > root@foreman ~ # ulimit > unlimited > root@foreman ~ # ls /*core* > ls: cannot access /*core*: No such file or directory > root@foreman ~ # ls /root/*core* > ls: cannot access /root/*core*: No such file or directory > ---- > > no 'limit' on ubuntu, i guess ulimit is right? > also did a 'find' for *core* - nothing :( > > > > On 31 March 2011 23:00, Jared Mauch <jared-li9M/[email protected]> wrote: > >> can you send the output of 'limit' and ls /*core* and ls /root/*core* >> >> - Jared >> >> On Mar 31, 2011, at 4:56 PM, Richard van Katwijk wrote: >> >> > I cannot seem to find any core dump. I get: >> > >> > sysmond: 21:19:20 about to abort and dump core (i think in /) >> > >> > but cant find anything there. Any hints as to what the core file may be >> named or where it may be? >> > >> > >> > On 31 March 2011 17:20, Jared Mauch <jared-li9M/[email protected]> wrote: >> > gdb /path/to/sysmond /path/to/corefile >> > >> > (gdb) where >> > >> > - Jared >> > >> > On Mar 31, 2011, at 11:19 AM, Richard van Katwijk wrote: >> > >> > > Hi Jared, >> > > >> > > I am not too familiar with gdb, do i need to run it as gbd sysmond or >> attach gdb to the process id? Neither seem to give anything useful. >> > > >> > > On 31 March 2011 15:30, Jared Mauch <jared-li9M/[email protected]> wrote: >> > > Can you gdb it and send the output of "where" to me? >> > > >> > > Jared Mauch >> > > >> > > On Mar 31, 2011, at 7:29 AM, Richard van Katwijk < >> [email protected]> wrote: >> > > >> > >> Hi, has anyone seen this before, or any idea what might cause it? >> > >> >> > >> My sysmon instance has been up and running for about a year, this is >> the second time i am seeing this, though today it happens almost as soon as >> i restart. >> > >> >> > >> Box is running Ubuntu 10.04 LTS and nothing has changed on that box >> in ages. >> > >> >> > >> Richard >> > >> >> > >> ================================================================ >> > >> >> > >> sysmond: 13:24:01 Starting sysmon v0.92.2 >> > >> *** stack smashing detected ***: /usr/local/bin/sysmond terminated >> > >> ======= Backtrace: ========= >> > >> /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x50)[0xb775d390] >> > >> /lib/tls/i686/cmov/libc.so.6(+0xe233a)[0xb775d33a] >> > >> /usr/local/bin/sysmond[0x8062086] >> > >> /usr/local/bin/sysmond[0x804ba4d] >> > >> /usr/local/bin/sysmond[0x804bf15] >> > >> /usr/local/bin/sysmond[0x804ca8d] >> > >> /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb7691bd6] >> > >> /usr/local/bin/sysmond[0x8049a71] >> > >> ======= Memory map: ======== >> > >> 08048000-0806c000 r-xp 00000000 08:01 151 >> /usr/local/bin/sysmond >> > >> 0806c000-0806d000 r--p 00023000 08:01 151 >> /usr/local/bin/sysmond >> > >> 0806d000-0806e000 rw-p 00024000 08:01 151 >> /usr/local/bin/sysmond >> > >> 0806e000-08073000 rw-p 00000000 00:00 0 >> > >> 08900000-08940000 rw-p 00000000 00:00 0 [heap] >> > >> b7641000-b765e000 r-xp 00000000 08:01 478 /lib/libgcc_s.so.1 >> > >> b765e000-b765f000 r--p 0001c000 08:01 478 /lib/libgcc_s.so.1 >> > >> b765f000-b7660000 rw-p 0001d000 08:01 478 /lib/libgcc_s.so.1 >> > >> b7660000-b7664000 r-xp 00000000 08:01 8150 /lib/tls/i686/cmov/ >> libnss_dns-2.11.1.so >> > >> b7664000-b7665000 r--p 00004000 08:01 8150 /lib/tls/i686/cmov/ >> libnss_dns-2.11.1.so >> > >> b7665000-b7666000 rw-p 00005000 08:01 8150 /lib/tls/i686/cmov/ >> libnss_dns-2.11.1.so >> > >> b766e000-b7678000 r-xp 00000000 08:01 8151 /lib/tls/i686/cmov/ >> libnss_files-2.11.1.so >> > >> b7678000-b7679000 r--p 00009000 08:01 8151 /lib/tls/i686/cmov/ >> libnss_files-2.11.1.so >> > >> b7679000-b767a000 rw-p 0000a000 08:01 8151 /lib/tls/i686/cmov/ >> libnss_files-2.11.1.so >> > >> b767a000-b767b000 rw-p 00000000 00:00 0 >> > >> b767b000-b77ce000 r-xp 00000000 08:01 8138 /lib/tls/i686/cmov/ >> libc-2.11.1.so >> > >> b77ce000-b77cf000 ---p 00153000 08:01 8138 /lib/tls/i686/cmov/ >> libc-2.11.1.so >> > >> b77cf000-b77d1000 r--p 00153000 08:01 8138 /lib/tls/i686/cmov/ >> libc-2.11.1.so >> > >> b77d1000-b77d2000 rw-p 00155000 08:01 8138 /lib/tls/i686/cmov/ >> libc-2.11.1.so >> > >> b77d2000-b77d5000 rw-p 00000000 00:00 0 >> > >> b77d5000-b77e8000 r-xp 00000000 08:01 8148 /lib/tls/i686/cmov/ >> libnsl-2.11.1.so >> > >> b77e8000-b77e9000 r--p 00012000 08:01 8148 /lib/tls/i686/cmov/ >> libnsl-2.11.1.so >> > >> b77e9000-b77ea000 rw-p 00013000 08:01 8148 /lib/tls/i686/cmov/ >> libnsl-2.11.1.so >> > >> b77ea000-b77ed000 rw-p 00000000 00:00 0 >> > >> b77ed000-b7802000 r-xp 00000000 08:01 8157 /lib/tls/i686/cmov/ >> libpthread-2.11.1.so >> > >> b7802000-b7803000 r--p 00014000 08:01 8157 /lib/tls/i686/cmov/ >> libpthread-2.11.1.so >> > >> b7803000-b7804000 rw-p 00015000 08:01 8157 /lib/tls/i686/cmov/ >> libpthread-2.11.1.so >> > >> b7804000-b7806000 rw-p 00000000 00:00 0 >> > >> b7806000-b7816000 r-xp 00000000 08:01 8158 /lib/tls/i686/cmov/ >> libresolv-2.11.1.so >> > >> b7816000-b7817000 r--p 00010000 08:01 8158 /lib/tls/i686/cmov/ >> libresolv-2.11.1.so >> > >> b7817000-b7818000 rw-p 00011000 08:01 8158 /lib/tls/i686/cmov/ >> libresolv-2.11.1.so >> > >> b7818000-b781a000 rw-p 00000000 00:00 0 >> > >> b7821000-b7824000 rw-p 00000000 00:00 0 >> > >> b7824000-b7825000 r-xp 00000000 00:00 0 [vdso] >> > >> b7825000-b7840000 r-xp 00000000 08:01 636 /lib/ld-2.11.1.so >> > >> b7840000-b7841000 r--p 0001a000 08:01 636 /lib/ld-2.11.1.so >> > >> b7841000-b7842000 rw-p 0001b000 08:01 636 /lib/ld-2.11.1.so >> > >> bf86e000-bf883000 rw-p 00000000 00:00 0 [stack] >> > >> sysmond: 13:24:23 about to abort and dump core (i think in /root) >> > >> >> > >> _______________________________________________ >> > >> Sysmon-help mailing list >> > >> Sysmon-help-li9M/[email protected] >> > >> https://puck.nether.net/mailman/listinfo/sysmon-help >> > > >> > >> > >> >> > --000e0cd5197cab164d049fce0cdf Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable This article contains some detail on when a core file may not be produced:<= br><a href=3D"http://manpages.ubuntu.com/manpages/intrepid/man5/core.5.html= ">http://manpages.ubuntu.com/manpages/intrepid/man5/core.5.html</a><br><br> I have been through each, and none should be the cause in my case.<br><br>I= have now started sysmon as root (the usual) in /tmp - lets see what it doe= s.....<span style=3D"border-collapse: separate; color: rgb(0, 0, 0); font-f= amily: Helvetica; font-size: 12px; font-style: normal; font-variant: normal= ; font-weight: normal; letter-spacing: normal; line-height: normal; text-in= dent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"><= span style=3D"border-collapse: separate; color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-= weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0= px; text-transform: none; white-space: normal; word-spacing: 0px;"><span st= yle=3D"border-collapse: separate; color: rgb(0, 0, 0); font-family: Helveti= ca; font-size: 12px; font-style: normal; font-variant: normal; font-weight:= normal; letter-spacing: normal; line-height: normal; text-indent: 0px; tex= t-transform: none; white-space: normal; word-spacing: 0px;"></span></span><= /span><br> <br><br><div class=3D"gmail_quote">On 31 March 2011 23:08, Richard van Katw= ijk <span dir=3D"ltr"><<a href=3D"mailto:[email protected]">richard= @three6five.com</a>></span> wrote:<br><blockquote class=3D"gmail_quote" = style=3D"margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 20= 4); padding-left: 1ex;"> :(<br><br>root@foreman ~ # ulimit<br>unlimited<br>root@foreman ~ # ls /*cor= e*<br>ls: cannot access /*core*: No such file or directory<br>root@foreman = ~ # ls /root/*core*<br>ls: cannot access /root/*core*: No such file or dire= ctory<br> ----<br><br>no 'limit' on ubuntu, i guess ulimit is right?<br>also = did a 'find' for *core* - nothing :(<div><div></div><div class=3D"h= 5"><br><br><br><div class=3D"gmail_quote">On 31 March 2011 23:00, Jared Mau= ch <span dir=3D"ltr"><<a href=3D"mailto:jared-li9M/[email protected]" target=3D= "_blank">jared-li9M/[email protected]</a>></span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0.8ex; borde= r-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">can you send the = output of 'limit' and ls /*core* and ls /root/*core*<br> <font color=3D"#888888"><br> - Jared<br> </font><div><div></div><div><br> On Mar 31, 2011, at 4:56 PM, Richard van Katwijk wrote:<br> <br> > I cannot seem to find any core dump. I get:<br> ><br> > sysmond: 21:19:20 about to abort and dump core (i think in /)<br> ><br> > but cant find anything there. Any hints as to what the core file may b= e named or where it may be?<br> ><br> ><br> > On 31 March 2011 17:20, Jared Mauch <<a href=3D"mailto:[email protected]= ether.net" target=3D"_blank">jared-li9M/[email protected]</a>> wrote:<br> > gdb /path/to/sysmond /path/to/corefile<br> ><br> > (gdb) where<br> ><br> > - Jared<br> ><br> > On Mar 31, 2011, at 11:19 AM, Richard van Katwijk wrote:<br> ><br> > > Hi Jared,<br> > ><br> > > I am not too familiar with gdb, do i need to run it as gbd sysmon= d or attach gdb to the process id? Neither seem to give anything useful.<br= > > ><br> > > On 31 March 2011 15:30, Jared Mauch <<a href=3D"mailto:jared@p= uck.nether.net" target=3D"_blank">jared-li9M/[email protected]</a>> wrote:<br> > > Can you gdb it and send the output of "where" to me?<br= > > ><br> > > Jared Mauch<br> > ><br> > > On Mar 31, 2011, at 7:29 AM, Richard van Katwijk <<a href=3D"m= ailto:[email protected]" target=3D"_blank">[email protected]</a>&= gt; wrote:<br> > ><br> > >> Hi, has anyone seen this before, or any idea what might cause= it?<br> > >><br> > >> My sysmon instance has been up and running for about a year, = this is the second time i am seeing this, though today it happens almost as= soon as i restart.<br> > >><br> > >> Box is running Ubuntu 10.04 LTS and nothing has changed on th= at box in ages.<br> > >><br> > >> Richard<br> > >><br> > >> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br> > >><br> > >> sysmond: 13:24:01 Starting sysmon v0.92.2<br> > >> *** stack smashing detected ***: /usr/local/bin/sysmond termi= nated<br> > >> =3D=3D=3D=3D=3D=3D=3D Backtrace: =3D=3D=3D=3D=3D=3D=3D=3D=3D<= br> > >> /lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x50)[0xb775d390]= <br> > >> /lib/tls/i686/cmov/libc.so.6(+0xe233a)[0xb775d33a]<br> > >> /usr/local/bin/sysmond[0x8062086]<br> > >> /usr/local/bin/sysmond[0x804ba4d]<br> > >> /usr/local/bin/sysmond[0x804bf15]<br> > >> /usr/local/bin/sysmond[0x804ca8d]<br> > >> /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb7691b= d6]<br> > >> /usr/local/bin/sysmond[0x8049a71]<br> > >> =3D=3D=3D=3D=3D=3D=3D Memory map: =3D=3D=3D=3D=3D=3D=3D=3D<br= > > >> 08048000-0806c000 r-xp 00000000 08:01 151 =A0 =A0 =A0 =A0/usr= /local/bin/sysmond<br> > >> 0806c000-0806d000 r--p 00023000 08:01 151 =A0 =A0 =A0 =A0/usr= /local/bin/sysmond<br> > >> 0806d000-0806e000 rw-p 00024000 08:01 151 =A0 =A0 =A0 =A0/usr= /local/bin/sysmond<br> > >> 0806e000-08073000 rw-p 00000000 00:00 0<br> > >> 08900000-08940000 rw-p 00000000 00:00 0 =A0 =A0 =A0 =A0 =A0[h= eap]<br> > >> b7641000-b765e000 r-xp 00000000 08:01 478 =A0 =A0 =A0 =A0/lib= /libgcc_s.so.1<br> > >> b765e000-b765f000 r--p 0001c000 08:01 478 =A0 =A0 =A0 =A0/lib= /libgcc_s.so.1<br> > >> b765f000-b7660000 rw-p 0001d000 08:01 478 =A0 =A0 =A0 =A0/lib= /libgcc_s.so.1<br> > >> b7660000-b7664000 r-xp 00000000 08:01 8150 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_dns-2.11.1.so" target=3D"_blank">libn= ss_dns-2.11.1.so</a><br> > >> b7664000-b7665000 r--p 00004000 08:01 8150 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_dns-2.11.1.so" target=3D"_blank">libn= ss_dns-2.11.1.so</a><br> > >> b7665000-b7666000 rw-p 00005000 08:01 8150 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_dns-2.11.1.so" target=3D"_blank">libn= ss_dns-2.11.1.so</a><br> > >> b766e000-b7678000 r-xp 00000000 08:01 8151 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_files-2.11.1.so" target=3D"_blank">li= bnss_files-2.11.1.so</a><br> > >> b7678000-b7679000 r--p 00009000 08:01 8151 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_files-2.11.1.so" target=3D"_blank">li= bnss_files-2.11.1.so</a><br> > >> b7679000-b767a000 rw-p 0000a000 08:01 8151 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnss_files-2.11.1.so" target=3D"_blank">li= bnss_files-2.11.1.so</a><br> > >> b767a000-b767b000 rw-p 00000000 00:00 0<br> > >> b767b000-b77ce000 r-xp 00000000 08:01 8138 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.= 1.so</a><br> > >> b77ce000-b77cf000 ---p 00153000 08:01 8138 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.= 1.so</a><br> > >> b77cf000-b77d1000 r--p 00153000 08:01 8138 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.= 1.so</a><br> > >> b77d1000-b77d2000 rw-p 00155000 08:01 8138 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libc-2.11.1.so" target=3D"_blank">libc-2.11.= 1.so</a><br> > >> b77d2000-b77d5000 rw-p 00000000 00:00 0<br> > >> b77d5000-b77e8000 r-xp 00000000 08:01 8148 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnsl-2.11.1.so" target=3D"_blank">libnsl-2= .11.1.so</a><br> > >> b77e8000-b77e9000 r--p 00012000 08:01 8148 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnsl-2.11.1.so" target=3D"_blank">libnsl-2= .11.1.so</a><br> > >> b77e9000-b77ea000 rw-p 00013000 08:01 8148 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libnsl-2.11.1.so" target=3D"_blank">libnsl-2= .11.1.so</a><br> > >> b77ea000-b77ed000 rw-p 00000000 00:00 0<br> > >> b77ed000-b7802000 r-xp 00000000 08:01 8157 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libpthread-2.11.1.so" target=3D"_blank">libp= thread-2.11.1.so</a><br> > >> b7802000-b7803000 r--p 00014000 08:01 8157 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libpthread-2.11.1.so" target=3D"_blank">libp= thread-2.11.1.so</a><br> > >> b7803000-b7804000 rw-p 00015000 08:01 8157 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libpthread-2.11.1.so" target=3D"_blank">libp= thread-2.11.1.so</a><br> > >> b7804000-b7806000 rw-p 00000000 00:00 0<br> > >> b7806000-b7816000 r-xp 00000000 08:01 8158 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libresolv-2.11.1.so" target=3D"_blank">libre= solv-2.11.1.so</a><br> > >> b7816000-b7817000 r--p 00010000 08:01 8158 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libresolv-2.11.1.so" target=3D"_blank">libre= solv-2.11.1.so</a><br> > >> b7817000-b7818000 rw-p 00011000 08:01 8158 =A0 =A0 =A0 /lib/t= ls/i686/cmov/<a href=3D"http://libresolv-2.11.1.so" target=3D"_blank">libre= solv-2.11.1.so</a><br> > >> b7818000-b781a000 rw-p 00000000 00:00 0<br> > >> b7821000-b7824000 rw-p 00000000 00:00 0<br> > >> b7824000-b7825000 r-xp 00000000 00:00 0 =A0 =A0 =A0 =A0 =A0[v= dso]<br> > >> b7825000-b7840000 r-xp 00000000 08:01 636 =A0 =A0 =A0 =A0/lib= /<a href=3D"http://ld-2.11.1.so" target=3D"_blank">ld-2.11.1.so</a><br> > >> b7840000-b7841000 r--p 0001a000 08:01 636 =A0 =A0 =A0 =A0/lib= /<a href=3D"http://ld-2.11.1.so" target=3D"_blank">ld-2.11.1.so</a><br> > >> b7841000-b7842000 rw-p 0001b000 08:01 636 =A0 =A0 =A0 =A0/lib= /<a href=3D"http://ld-2.11.1.so" target=3D"_blank">ld-2.11.1.so</a><br> > >> bf86e000-bf883000 rw-p 00000000 00:00 0 =A0 =A0 =A0 =A0 =A0[s= tack]<br> > >> sysmond: 13:24:23 about to abort and dump core (i think in /r= oot)<br> > >><br> > >> _______________________________________________<br> > >> Sysmon-help mailing list<br> > >> <a href=3D"mailto:Sysmon-help-li9M/[email protected]" target=3D"_bla= nk">Sysmon-help-li9M/[email protected]</a><br> > >> <a href=3D"https://puck.nether.net/mailman/listinfo/sysmon-he= lp" target=3D"_blank">https://puck.nether.net/mailman/listinfo/sysmon-help<= /a><br> > ><br> ><br> ><br> <br> </div></div></blockquote></div><br> </div></div></blockquote></div><br> --000e0cd5197cab164d049fce0cdf-- --===============0116993567== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sysmon-help mailing list Sysmon-help-li9M/[email protected] https://puck.nether.net/mailman/listinfo/sysmon-help --===============0116993567==--