Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  2. ZBX-4

Oracle alert logs (possible 0x00 issue)



    • Type: Incident report
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 1.4, 1.4.1, 1.4.2
    • Fix Version/s: 1.4.2
    • Component/s: Agent (G), Server (S)
    • Labels:


      Hi folks.

      Our company successfully uses Zabbix to monitor hosts and services for some time. But when we tried to implement the monitoring of Oracle alert logs we've discovered that sometimes it does not work as it supposed to. Out guys found the weakness in src/zabbix_agent/logfiles.c file that causes 0x00-containing strings in logfiles to be incorrectly processed. Here's the fragment of the mail:

      ====== [citate] =======

      did find the cause of the problem that I told you about with monitoring
      Oracle alert logs.... It is basically a "bug" in Zabbix agent...
      Basically, the situation is not really ordinary, but still

      For some reason, Oracle can have a symbol with hex value of 00 in the log.
      I did see this on alert log on the statement that I executed from SQL Navigator. When Zabbix was reading the strings from the log file it did
      increment it's "last log size" not by number of bytes read but by the length
      of the string it got. The trick is that in C strings a zero terminated, that
      is, 00 indicates end of string. So, when let's say our string in file is (hex
      values in <>) abcd<00><0a>, the representation of read data is abcd<00><0a><00> But if you call strlen on this, you will get 4, whereas we did read 6 bytes... So, what agent was doing is saving the log size as position of this <00> and trying to read from there basically in a loop, because it read from <00>, got the string length of 0, increased log size by 0 and was starting over again....

      Below is the code and what I did to fix it (src/zabbix_agent/logfiles.c). See
      section in bold at the bottom to see what I changed.

      I think we will need to submit patch to Zabbix on this as this might affect
      not only us


      1.4.1 code does look a bit different, but has the same issue as it uses strlen there.

      ===== [end of citate] =========

      I would like to ask whether anyone has the same problem and to ask Zabbix devel team to acknowledge or to analyze the issue.

      Attached is the fragment of src/zabbix_agent/logfiles.c with fixes (version 1.1.7).

      Thanks in advance,
      Alexander Khimich

      Network and systems administrator
      Pontis Ukraine.
      Attached Files
      File Type: txt logfile.txt (3.0 KB, 11 views)





            Unassigned Unassigned
            alexei Alexei Vladishev
            0 Vote for this issue
            0 Start watching this issue