Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  2. ZBX-22871

Zabbix agent crash (both generations) on RH7,8 while checking logs with a global regular expression


    • Sprint 101 (Jun 2023), Sprint 102 (Jul 2023), Sprint 103 (Aug 2023)
    • 0.5

      Steps to reproduce:

      Tested on RHEL 7 and RHEL 8, does not matter. Agent fails on both.

      Agent versions tested: zabbix-agent2-6.0.17, zabbix-agent-6.0.12, zabbix-agent-6.0.18 (patched for additional logging)

      Create a global regular expression. (This is important, because you can’t reproduce with regex in item key directly)

      Expression type: Result is FALSE

      Expression: NBSX.TT (you can experiment, but other patterns like “NBSX” does not crash)

      Case sensitive: NO (This is important, because agent does not crash with Case sensitive: YES)

      Create log item with key that references the global regexp from previous step and update interval of 1 second tor quick troubleshooting.

      log[/var/log/zabbix/test.log,@Regex TEST2,,1000,skip,,]

      Run Zabbix Agent with DebugLevel=5 and tail -f the log file on one SSH session.

      Feed the following word in the log:

      echo 'Panbūstas' >> /var/log/zabbix/test.log

      Observe that agent 2 freezes and gets restarted automatically or simply crashes in case of old agent.

      It does not fail when you use regular expression within item key itself, but we need to use global regex because we have over 30 conditions to one expression.

      Weird thing is that we have to use exactly the Lithuanian word Panbūstas . You can try with other words, but seems that exactly this ASCII sequence gets parsed in a weird way that kills agent

      Our current workaround in production is to use Agent 2 from 5.0.31.

            wiper Andris Zeila
            elina.kuzyutkina Elina Kuzyutkina (Inactive)
            Team A
            0 Vote for this issue
            8 Start watching this issue