logstash 6.2.0 StackOverFlowError

fragfutter commented 5 years ago

Starting with logstash 6.2.0 i get a stackoverflow after 100 sflow packages.

steps to reproduce

download logstash (curl -L -Ohttps://artifacts.elastic.co/downloads/logstash/logstash-6.2.0.tar.gz)
install plugin (cd logtash; ./bin/logstash-plugin install logstash-codec-sflow)
run with config (./bin/logstash -f ...)
replay the same sample of sflow packages multiple times (for i in $(seq 20); do echo $i; udpreplay -c 100 sample.pcap; done)

the sample contains 10 sflow packages. After about 8 replays logstash will crash with stackoverflow.

This is reproducable with other samples of sflow packages.

I tested with 6.1.0 (works), 6.1.3 (works), 6.2.0 (crash), 6.2.2 (crash), 6.5.4 (crash)

logstash config is

input {
    udp {
        port => 6343
        codec => sflow
        type => sflow
    }
}
output {
    stdout {
    }
}

removing the sflow codec it works in all versions.

kzemek commented 5 years ago

@fragfutter Can you include the pcap sample that reproduces the issue for you? FWIW, we're running logstash-codec-sflow with Logstash 7.0+ right now and have not encountered any segfaults so far.

fragfutter commented 5 years ago

checked with 7.2 and oracle-jdk8 still crashes checked with 7.2 and openjdk11 still crashes

i attached a pcap with a single package. I just run a loop over it to send it into logstash using udpreplay and can crash logstash with it.

one.pcap.gz

robcowart commented 5 years ago

FWIW, my recommendation for any production environment is Logstash 6.1.4 (oracle or open JDK8) with updated plugins. It was the last truly stable version. Everytime I have tried to move to a newer version it has been an exercise in futility.

path-network / logstash-codec-sflow

logstash 6.2.0 StackOverFlowError #16