search

splunk / splunk-connect-for-syslog

Splunk Connect for Syslog
Apache License 2.0
152 stars 108 forks source link

Segmentation fault when using custom parser in sc4s 3.29.x and 3.30.0 #2568

Closed ehlo550 closed 1 month ago

ehlo550 commented 1 month ago

Was the issue replicated by support? No

What is the sc4s version ? 3.28.1: working 3.29.x: not working 3.30.0: not working

Which operating system (including its version) are you using for hosting SC4S? Ubuntu 20.4.2

Which runtime (Docker, Podman, Docker Swarm, BYOE, MicroK8s) are you using for SC4S? kubernetes Server Version: v1.28.12

Is the issue related to local customization? Yes. The pod is stable without custom parsers. The pod crashes when a custom parser is used.

When using the debug option, no config can be found in /tmp/.

Describe the bug When upgrading sc4s to 3.30.0 my kubernetes pods are crashing with a segmentation fault message when syslog-ng is started.

[sc4s-splunk-connect-for-syslog-1] syslog-ng checking config
[sc4s-splunk-connect-for-syslog-1] sc4s version=3.30.0
[sc4s-splunk-connect-for-syslog-1] /entrypoint.sh: line 225:   109 Segmentation fault      (core dumped) $SC4S_SBIN/syslog-ng --no-caps $SC4S_CONTAINER_OPTS -s >> $SC4S_VAR/log/syslog-ng.out 2> $SC4S_VAR/log/syslog-ng.err
[sc4s-splunk-connect-for-syslog-1] starting goss
[sc4s-splunk-connect-for-syslog-1] /entrypoint.sh: line 242:   116 Segmentation fault      (core dumped) syslog-ng -s --no-caps
rjha-splunk commented 1 month ago

With the release of new version, the segmentation fault is fixed.