-
Incident report
-
Resolution: Fixed
-
Major
-
1.8.13
-
None
-
Agent: Linux x86_64
Server: Linux x86_64
But perhaps other environments are also affected.
Almost same issue with ZBXNEXT-1220.
I know 1.8.x will not change the DB schema and 1.8.x dosen't support over 2GB log file.
So, I don't expect Zabbix to be fixed to become monitor over 2GB log file.
However I think following behavior is a problem.
"If once Agent monitor a log file more than 2GB and then Agent restarted, the log will be never monitored"
Because if 64bit agent send "lastlogsize" over 32bit value, atoi() in server will overflow and receive the value as negative value.
------------------------------------------------------------ branches/1.8 (r27653)-------------------------------------------------------
src/zabbix_server/trapper/trapper.c:369: av.lastlogsize = atoi(lastlogsize);
----------------------------------------------------------------------------------------------------------------------------------------------------
Then if agent restart, agent will monitor the log file from negative value "lastlogsize".
Because "lastlogsize" is negative, the lseek will never succeed and the "lastlogsize" will never become positive value.
------------------------------------------------------------ branches/1.8 (r27653)-------------------------------------------------------
src/zabbix_agent/logfiles.c:501: if ((off_t)-1 != lseek(fd, (off_t)*lastlogsize, SEEK_SET))
src/zabbix_agent/logfiles.c:628: if ((off_t)-1 != lseek(f, (off_t)*lastlogsize, SEEK_SET))
----------------------------------------------------------------------------------------------------------------------------------------------------
I suggest Zabbix 1.8.x to return NOTSUPPORTED if the log file is over 2GB.
And if the log file become less 2GB, Zabbix will monitor again the log file.
BTW, I think ZBXNEXT-1220 is come from what I told Alexei at Japanese Zabbix meeting last week.
I told Alexei about this bug at there.