Hi folks.
Our company successfully uses Zabbix to monitor hosts and services for some time. But when we tried to implement the monitoring of Oracle alert logs we've discovered that sometimes it does not work as it supposed to. Out guys found the weakness in src/zabbix_agent/logfiles.c file that causes 0x00-containing strings in logfiles to be incorrectly processed. Here's the fragment of the mail:
====== [citate] =======
did find the cause of the problem that I told you about with monitoring
Oracle alert logs.... It is basically a "bug" in Zabbix agent...
Basically, the situation is not really ordinary, but still
For some reason, Oracle can have a symbol with hex value of 00 in the log.
I did see this on alert log on the statement that I executed from SQL Navigator. When Zabbix was reading the strings from the log file it did
increment it's "last log size" not by number of bytes read but by the length
of the string it got. The trick is that in C strings a zero terminated, that
is, 00 indicates end of string. So, when let's say our string in file is (hex
values in <>) abcd<00><0a>, the representation of read data is abcd<00><0a><00> But if you call strlen on this, you will get 4, whereas we did read 6 bytes... So, what agent was doing is saving the log size as position of this <00> and trying to read from there basically in a loop, because it read from <00>, got the string length of 0, increased log size by 0 and was starting over again....
Below is the code and what I did to fix it (src/zabbix_agent/logfiles.c). See
section in bold at the bottom to see what I changed.
I think we will need to submit patch to Zabbix on this as this might affect
not only us
[skipped]
1.4.1 code does look a bit different, but has the same issue as it uses strlen there.
===== [end of citate] =========
I would like to ask whether anyone has the same problem and to ask Zabbix devel team to acknowledge or to analyze the issue.
Attached is the fragment of src/zabbix_agent/logfiles.c with fixes (version 1.1.7).
Thanks in advance,
Alexander Khimich
Network and systems administrator
Pontis Ukraine.
Our company successfully uses Zabbix to monitor hosts and services for some time. But when we tried to implement the monitoring of Oracle alert logs we've discovered that sometimes it does not work as it supposed to. Out guys found the weakness in src/zabbix_agent/logfiles.c file that causes 0x00-containing strings in logfiles to be incorrectly processed. Here's the fragment of the mail:
====== [citate] =======
did find the cause of the problem that I told you about with monitoring
Oracle alert logs.... It is basically a "bug" in Zabbix agent...
Basically, the situation is not really ordinary, but still
For some reason, Oracle can have a symbol with hex value of 00 in the log.
I did see this on alert log on the statement that I executed from SQL Navigator. When Zabbix was reading the strings from the log file it did
increment it's "last log size" not by number of bytes read but by the length
of the string it got. The trick is that in C strings a zero terminated, that
is, 00 indicates end of string. So, when let's say our string in file is (hex
values in <>) abcd<00><0a>, the representation of read data is abcd<00><0a><00> But if you call strlen on this, you will get 4, whereas we did read 6 bytes... So, what agent was doing is saving the log size as position of this <00> and trying to read from there basically in a loop, because it read from <00>, got the string length of 0, increased log size by 0 and was starting over again....
Below is the code and what I did to fix it (src/zabbix_agent/logfiles.c). See
section in bold at the bottom to see what I changed.
I think we will need to submit patch to Zabbix on this as this might affect
not only us
[skipped]
1.4.1 code does look a bit different, but has the same issue as it uses strlen there.
===== [end of citate] =========
I would like to ask whether anyone has the same problem and to ask Zabbix devel team to acknowledge or to analyze the issue.
Attached is the fragment of src/zabbix_agent/logfiles.c with fixes (version 1.1.7).
Thanks in advance,
Alexander Khimich
Network and systems administrator
Pontis Ukraine.
Comment