[ZBX-23068] Usage of system.sw.os.get item key eventually crashes Zabbix agent on Windows Created: 2023 Jul 06  Updated: 2024 Apr 10  Resolved: 2023 Aug 14

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 6.4.4, 7.0.0alpha2
Fix Version/s: 6.4.6rc1, 7.0.0alpha4, 7.0 (plan)

Type: Problem report Priority: Trivial
Reporter: Konstantins Prutkovs (Inactive) Assignee: Vladislavs Sokurenko
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: Text File zabbix_agentd.log    
Issue Links:
Causes
caused by ZBXNEXT-6848 Get exact Windows Build number and pa... Closed
Team: Team A
Sprint: Sprint 103 (Aug 2023)
Story Points: 1

 Description   

Steps to reproduce:

  1. Create item system.sw.os.get on a windows host.
  2. Start collecting the item.

Result:
Zabbix agent runs normally, then spontaneously crashes. The error is 0xc0000374 (stack heap corruption) and happens seemingly randomly within WinAPI calls, not only the ones related to this item key.

Expected:
Zabbix agent does not crash

 Comments   
Comment by Mihails Prihodko [ 2023 Jul 12 ]

I managed to reproduce the issue at current release/6.4 c096e125c3d by following hints provided by Konstantin.

Steps to reproduce:

  1. Install Zabbix agent 1 on Windows machine. Install Zabbix server, database, frontend on Linux machine.
  2. Remove the default Zabbix server host for convenience.
  3. Add new host Windows host.
  4. Add items with the following keys to the Windows host. Set update intervals 10s for all the items.
    1. eventlog[Application] (type Zabbix agent active)
    2. system.sw.os.get (type Zabbix agent)
  5. Start Zabbix server and Zabbix agent.
  6. Zabbix agent crash with the exception described above happens in the "active checks" process after some time monitoring (about 2 minutes).

An example of Zabbix agent log with debug level trace (and also some custom logs) zabbix_agentd.log

The Microsoft Error Lookup Tool provides the following information
https://learn.microsoft.com/en-us/windows/win32/debug/system-error-code-lookup-tool 

>Err_6.4.5.exe c0000374
# for hex 0xc0000374 / decimal -1073740940
  STATUS_HEAP_CORRUPTION                                         ntstatus.h
# A heap has been corrupted.
# 1 matches found for "c0000374"
Comment by Vladislavs Sokurenko [ 2023 Aug 11 ]

Fixed in:

Comment by Vladislavs Sokurenko [ 2023 Aug 11 ]

Caused by ZBXNEXT-6848

Generated at Fri May 02 09:24:41 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.