[ZBX-10086] cannot disable core dump at server startup Created: 2015 Nov 17  Updated: 2017 May 30  Resolved: 2016 Mar 14

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G), Proxy (P), Server (S)
Affects Version/s: 3.0.0alpha4
Fix Version/s: 3.0.2rc1, 3.2.0alpha1

Type: Incident report Priority: Critical
Reporter: itnihao Assignee: Unassigned
Resolution: Fixed Votes: 0
Labels: encryption
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: PNG File Can't support SMTP.png    

 Description   

```
30565:20151116:181908.788 Starting Zabbix Server. Zabbix 3.0.0alpha4 (revision 56592).
30565:20151116:181908.788 ****** Enabled features ******
30565:20151116:181908.788 SNMP monitoring: YES
30565:20151116:181908.788 IPMI monitoring: YES
30565:20151116:181908.788 Web monitoring: YES
30565:20151116:181908.788 VMware monitoring: YES
30565:20151116:181908.788 SMTP authentication: NO
30565:20151116:181908.788 Jabber notifications: NO
30565:20151116:181908.788 Ez Texting notifications: YES
30565:20151116:181908.788 ODBC: YES
30565:20151116:181908.788 SSH2 support: YES
30565:20151116:181908.788 IPv6 support: YES
30565:20151116:181908.788 TLS support: NO
30565:20151116:181908.788 ******************************
30565:20151116:181908.789 using configuration file: /etc/zabbix/zabbix_server.conf
30565:20151116:181908.789 cannot set resource limit: [13] Permission denied
30565:20151116:181908.789 cannot disable core dump, exiting...
11474:20151117:100220.874 Starting Zabbix Server. Zabbix 3.0.0alpha4 (revision 56592).
11474:20151117:100220.874 ****** Enabled features ******
11474:20151117:100220.874 SNMP monitoring: YES
11474:20151117:100220.874 IPMI monitoring: YES
11474:20151117:100220.874 Web monitoring: YES
11474:20151117:100220.874 VMware monitoring: YES
11474:20151117:100220.874 SMTP authentication: NO
11474:20151117:100220.874 Jabber notifications: NO
11474:20151117:100220.874 Ez Texting notifications: YES
11474:20151117:100220.874 ODBC: YES
11474:20151117:100220.874 SSH2 support: YES
11474:20151117:100220.874 IPv6 support: YES
11474:20151117:100220.874 TLS support: NO
11474:20151117:100220.874 ******************************
11474:20151117:100220.874 using configuration file: /etc/zabbix/zabbix_server.conf
11474:20151117:100220.875 cannot set resource limit: [13] Permission denied
11474:20151117:100220.875 cannot disable core dump, exiting...
```



 Comments   
Comment by itnihao [ 2015 Nov 17 ]

configure:

./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --target=x86_64-redhat-linux-gnu --program-prefix= --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --enable-dependency-tracking --enable-server --enable-proxy --enable-java --enable-agent --enable-ipv6 --with-net-snmp --with-openipmi --with-unixodbc --with-ldap --with-ssh2 --with-libcurl --with-libxml2 --with-openssl --sysconfdir=/etc/zabbix --datadir=/var/lib --enable-server --with-mysql '--with-cc-opt=-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic '

but can't support SMTP:
SMTP authentication: NO

Comment by Aleksandrs Saveljevs [ 2015 Nov 17 ]

Problem introduced with encryption, ZBXNEXT-1263.

Comment by Andris Mednis [ 2015 Nov 17 ]

I tried to compile on Debian testing (Debian GNU/Linux stretch/sid, Linux 4.2.0-1-amd64) with gcc 5.2.1.
It did not recognize option '--with-cc-opt", so I put options into file "my_options.txt":

-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic

and configured:

$ CC=gcc-5 CFLAGS=$(cat my_options.txt) ./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --target=x86_64-redhat-linux-gnu --prefix=`pwd` --enable-dependency-tracking --enable-server --enable-proxy --enable-agent --enable-ipv6 --with-net-snmp --with-openipmi --with-unixodbc --with-ldap --with-ssh2 --with-libcurl --with-libxml2 --with-openssl  --enable-server --with-postgresql 2>&1 | tee my_configure.out
....
  Compiler:              gcc-5
  Compiler flags:        -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic    -I/usr/include/postgresql   -I/usr/include/libxml2    -I/usr/local/include -I/usr/lib/x86_64-linux-gnu/perl/5.20/CORE -I. -I/usr/include -I/usr/include -I/usr/include -I/usr/include -I/usr/include  

  Enable server:         yes
  Server details:
    With database:         PostgreSQL
    WEB Monitoring:        cURL
    Native Jabber:         no
    SNMP:                  yes
    IPMI:                  yes
    SSH:                   yes
    TLS:                   OpenSSL
    ODBC:                  yes
    Linker flags:          -rdynamic        -L/usr/lib/x86_64-linux-gnu      -L/usr/lib/x86_64-linux-gnu -L/usr/lib -L/usr/lib -L/usr/lib -L/usr/lib  -L/usr/lib/x86_64-linux-gnu
    Libraries:             -lodbc -lm -ldl  -lresolv -lodbc      -lpq   -lxml2  -lodbc  -lnetsnmp -lssh2 -lOpenIPMI -lOpenIPMIposix -lssl -lcrypto -lldap -llber   -lcurl
....

It worked without errors.
Could it be Red Hat specific policy restrictions ?

Comment by Atsushi Tanaka [ 2016 Jan 25 ]

If you want enable SMTP authentication, you must use libcurl version 7.20.0 or later.
Please check include file: include/sysinc.h.
If you use RHEL 6(CentOS 6), RHEL 6's default libcurl version is 7.19.7.

And, zabbix_server does not output the log?
ex.

 31724:20160125:122203.114 cannot set resource limit: [13] Permission denied
 31724:20160125:122203.114 cannot disable core dump, exiting...

This is I think the process is limited by SELinux.
Please check your SELinux setting.

Comment by itnihao [ 2016 Feb 15 ]

curl version 7.19.7. For some reason that doesn't support NTLM authentication

https://bugzilla.redhat.com/show_bug.cgi?id=603783

so SMTP authentication: NO,should be update libcurl >7.20

Comment by itnihao [ 2016 Feb 15 ]

In CentOS 6,you can use curl rpm from https://github.com/zabbixcn/curl-rpm

Comment by itnihao [ 2016 Feb 15 ]

should be Comment curl version > 7.20

https://www.zabbix.com/documentation/3.0/manual/config/notifications/media/email
Comment by Aleksandrs Saveljevs [ 2016 Feb 16 ]

Let's continue the discussion on SMTP authentication in ZBX-9854. This task is originally about not being able to disable the core dump.

Comment by Martijn Storck [ 2016 Feb 25 ]

Is the core dump disable issue handled in a separate ticket? This completely breaks Zabbix Agent 3.0 on CentOS 6. Using a community-supplied curl RPM is not an acceptable workaround for an Enterprise Linux OS.

Comment by Andris Mednis [ 2016 Feb 25 ]

Disabling of core dump was added in Zabbix 3.0 as part of encryption support as a recommended practice. However, it was added regardless of encryption support - this can be counted as a bug. We can consider removing it when compiling without encryption support. Could it be SELinux policy which blocks using setrlimit() by Zabbix ? https://forum.nginx.org/read.php?2,254456,254496 seem to deal with setrlimit() in SELinux.

Comment by Andris Mednis [ 2016 Mar 11 ]

Fixed in development branch svn://svn.zabbix.com/branches/dev/ZBX-10086 .

Comment by Aleksandrs Saveljevs [ 2016 Mar 14 ]

(1) Function zbx_coredump_disable() was not wrapped in #ifdef ENCRYPTION in include/zbxnix.h file. That meant that there would be a prototype, but no implementation for the function if compiled without encryption. It would be better not to provide the prototype in this case, too, so that a compiler can explicitly complain about the missing prototype, rather than just the linking issue.

asaveljevs RESOLVED in r58983.

andris Thanks! Reviewed, accepted.

Comment by Andris Mednis [ 2016 Mar 14 ]

Fixed in versions:

  • pre-3.0.2rc1 r58988,
  • pre-3.1.0 (trunk) r58989.

No changes to documentation

Comment by patrik uytterhoeven [ 2016 Mar 16 ]

I had this same issue on RHEL 7.1
I had to upgrade to RHEL 7.2 to get zabbix working with the latest zabbix 3.0.1

Comment by Atsushi Tanaka [ 2016 Mar 16 ]

If you can not start in RHEL 7.1, it is because of another bug.
Please update your OS by yum update.

Bug 1071171 - crash when linking libtspi and libmysqlclient [NEEDINFO]
https://bugzilla.redhat.com/show_bug.cgi?id=1071171
Bug 1069079 - crash when linking libgnutls and libmysqlclient
https://bugzilla.redhat.com/show_bug.cgi?id=1069079

Comment by patrik uytterhoeven [ 2016 Mar 16 ]

as you can see that's what i did
but i means Zabbix 3 can not run on rhel systems with 7.1 or with atleast certain packages updated
this should be well documented in the installation guide else people will run into issues

Comment by Andris Mednis [ 2016 Mar 16 ]

Added a note about disabling core dumps in documentation at https://www.zabbix.com/documentation/3.0/manual/installation/requirements#supported_platforms .

sasha Thanks! CLOSED

Comment by Tomas Jecha [ 2016 Aug 01 ]

Workaround:
Having RHEL 7.1 you can just update selinux-policy without upgrading to 7.2:

yum clean all
yum update selinux-policy.noarch selinux-policy-targeted.noarch
Comment by patrik uytterhoeven [ 2016 Aug 01 ]

yes a note was already added to the zabbix docs for this
that selinux could be blocking
https://www.zabbix.com/documentation/3.0/manual/installation/requirements?s[]=selinux

Generated at Fri Mar 29 16:05:28 EET 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.