search

elastic / logstash-forwarder

An experiment to cut logs in preparation for processing elsewhere. Replaced by Filebeat: https://github.com/elastic/beats/tree/master/filebeat
Other
1.79k stars 416 forks source link

Unhandled exception 'Unknown frame type' #255

Closed tthef closed 9 years ago

tthef commented 10 years ago

When something that does not talk the lumberjack protocol tries to connect on the lumberjack port, the lubmerjack listener crashes. For exemaple, when the port is hit by the openvas scanner you get:

RuntimeError: Unknown frame type: 69 header at /opt/logstash/vendor/bundle/jruby/1.9/gems/jls-lumberjack-0.0.20/lib/lumberjack/server.rb:142

This should be handled more gracefully, I think.

jordansissel commented 10 years ago

Agreed.

mzimmerman commented 9 years ago

Welp, that explains why my service keeps crashing after a Nessus scan! This is a fragile service.

jordansissel commented 9 years ago

This is a fragile service.

Not intentionally.

ssoroka-se commented 9 years ago

Clearly the server should not be raising exceptions for poorly formatted requests!

jordansissel commented 9 years ago

@ssoroka-se if only computers were that simple :)

jordansissel commented 9 years ago

For folks hitting this, please know that we know about this bug, have reproduced it, and will be fixing it soon. Intention is to include the fix in Logstash 1.5.0

leaskim commented 9 years ago

Hello, any news on this bug ? Using NXLog to send logs from a Windows 2008 server make my logstash crash, "unknown frame type: 48". Thanks,

jordansissel commented 9 years ago

Fixed recently.

ph commented 9 years ago

Fixed in https://github.com/logstash-plugins/logstash-input-lumberjack/pull/8