[ZBX-8590] Windows agent crash caused by eventlog key Created: 2014 Aug 07  Updated: 2017 May 30  Resolved: 2015 Jan 05

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: None
Affects Version/s: None
Fix Version/s: None

Type: Incident report Priority: Critical
Reporter: Kodai Terashima Assignee: Unassigned
Resolution: Duplicate Votes: 1
Labels: Windows, crash, eventlog
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Zabbix 2.2.4, Windows 2008R2


Issue Links:
Duplicate
duplicates ZBX-8236 Zabbix agent 2.2 memory leak on Windows. Closed

 Description   

Windows 2.2.4 agent crashed on Windows 2008R2. It seems that the cause of the crash is reading eventlog.



 Comments   
Comment by Kodai Terashima [ 2014 Aug 07 ]

Windows agent stopped with logs below:

  1708:20140801:154205.908 End of process_eventlog6():SUCCEED
  1708:20140801:154205.908 In process_eventlog6() source: 'System' previous lastlogsize: 15929, FirstID: 1, LastID: 17277
  1708:20140801:154205.908 In zbx_get_eventlog_message6() lastlogsize:15930
  1708:20140801:154205.908 In expand_message6()
  1708:20140801:154205.908 End of expand_message6(): XXXXXX
Comment by Ryan Armstrong [ 2014 Sep 10 ]

We are experiencing the same issue on a number of Windows 2008R2 servers with v2.2.5.
If I disable all event log items, the agent not longer crashes. Our items keys are:

  • eventlog[Application,,"Critical|Error"]
  • eventlog[System,,"Critical|Error"]

Here's the stack trace from a crash dump:

zabbix_agentd!regcomp(void)+0xf3 [c:\...\src\libs\zbxregexp\gnuregex.c @ 4858]
zabbix_agentd!zbx_regexp(char * string = 0x00000005`00000000 "--- memory read error at address 0x00000005`00000000 ---", char * pattern = 0x00000000`00000000 "", int * len = 0x00000000`003c1050, int flags = 0n0)+0x8e [c:\...\src\libs\zbxregexp\zbxregexp.c @ 51]
zabbix_agentd!regexp_match_ex_regsub(char * string = 0x00000000`049cc610 "1054", char * pattern = 0x00000001`400520d9 "H???", int case_sensitive = 0n8, char * output_template = 0x00000000`003c1050 "10.0.0.1", char ** output = 0x00000000`00000000)+0x2e [c:\...\src\libs\zbxregexp\zbxregexp.c @ 357]
zabbix_agentd!regexp_sub_ex(struct zbx_vector_ptr_t * regexps = 0x00000000`00000400, char * string = 0x00000000`003c1050 "10.0.0.1", char * pattern = 0x00000000`00000400 "--- memory read error at address 0x00000000`00000400 ---", int case_sensitive = 0n0, char * output_template = 0x00000000`00000000 "", char ** output = 0x00000000`00000000)+0x69 [c:\...\src\libs\zbxregexp\zbxregexp.c @ 487]
zabbix_agentd!regexp_match_ex(struct zbx_vector_ptr_t * regexps = 0x00000000`003c1050, char * string = 0x00000000`003c1050 "10.0.0.1", char * pattern = 0x00000001`400750a0 "%lu", int case_sensitive = 0n1054)+0x15 [c:\...\src\libs\zbxregexp\zbxregexp.c @ 548]
zabbix_agentd!process_active_checks(char * server = 0x01cfccae`033b38e0 "--- memory read error at address 0x01cfccae`033b38e0 ---", unsigned short port = 1)+0xaf6 [c:\...\src\zabbix_agent\active.c @ 1134]
zabbix_agentd!active_checks_thread(void * args = 0x00000000`00000000)+0x151 [c:\...\src\zabbix_agent\active.c @ 1351]
zabbix_agentd!_callthreadstartex(void)+0x17 [f:\dd\vctools\crt\crtw32\startup\threadex.c @ 376]
zabbix_agentd!_threadstartex(void * ptd = 0x00000000`003794d0)+0x102 [f:\dd\vctools\crt\crtw32\startup\threadex.c @ 354]
kernel32!BaseThreadInitThunk+0xd
ntdll!RtlUserThreadStart+0x1d
Comment by Ryan Armstrong [ 2014 Sep 10 ]

This issues is resolved for me in v2.2.6. I imagine this is fixed by ZBX-8236

Comment by Kazuo Ito [ 2014 Dec 16 ]

Hi Ryan,

Thank you for the information!
How did you take the crash dump?

Best Regards,
KAZ

Comment by Ryan Armstrong [ 2014 Dec 17 ]

Hi Kaz,

I compiled the agent binary with debug symbols, loaded the symbols into WinDbg and ran the agent in WinDbg.
After it crashed I did a '!analyze' and it prints a nice stack trace.

Regards

Comment by Kazuo Ito [ 2014 Dec 18 ]

Hi Ryan,

I'll try the WinDbg.
Thank you!

Comment by Kazuo Ito [ 2015 Jan 05 ]

Confirmed this problem was fixed with ZBX-8236.
Closing this issue as duplicate.

Generated at Thu Apr 25 20:37:41 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.