Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-5027

Once monitoring a log file more than 2GB, the log will be never monitored.

XMLWordPrintable

    • Icon: Incident report Incident report
    • Resolution: Fixed
    • Icon: Major Major
    • 1.8.14rc1
    • 1.8.13
    • Agent (G), Proxy (P), Server (S)
    • None
    • Agent: Linux x86_64
      Server: Linux x86_64
      But perhaps other environments are also affected.

      Almost same issue with ZBXNEXT-1220.
      I know 1.8.x will not change the DB schema and 1.8.x dosen't support over 2GB log file.
      So, I don't expect Zabbix to be fixed to become monitor over 2GB log file.

      However I think following behavior is a problem.
      "If once Agent monitor a log file more than 2GB and then Agent restarted, the log will be never monitored"
      Because if 64bit agent send "lastlogsize" over 32bit value, atoi() in server will overflow and receive the value as negative value.

      ------------------------------------------------------------ branches/1.8 (r27653)-------------------------------------------------------
      src/zabbix_server/trapper/trapper.c:369: av.lastlogsize = atoi(lastlogsize);
      ----------------------------------------------------------------------------------------------------------------------------------------------------

      Then if agent restart, agent will monitor the log file from negative value "lastlogsize".
      Because "lastlogsize" is negative, the lseek will never succeed and the "lastlogsize" will never become positive value.

      ------------------------------------------------------------ branches/1.8 (r27653)-------------------------------------------------------
      src/zabbix_agent/logfiles.c:501: if ((off_t)-1 != lseek(fd, (off_t)*lastlogsize, SEEK_SET))
      src/zabbix_agent/logfiles.c:628: if ((off_t)-1 != lseek(f, (off_t)*lastlogsize, SEEK_SET))
      ----------------------------------------------------------------------------------------------------------------------------------------------------

      I suggest Zabbix 1.8.x to return NOTSUPPORTED if the log file is over 2GB.
      And if the log file become less 2GB, Zabbix will monitor again the log file.

      BTW, I think ZBXNEXT-1220 is come from what I told Alexei at Japanese Zabbix meeting last week.
      I told Alexei about this bug at there.

            dimir dimir
            tsuzuki Takanori Suzuki
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: