Zabbix 1.1.3 - Server dies after receiving certain windows eventlog

[qix]

Hello all,

Lately I have been running into the following problem.
When Zabbix receives certain logs from our windows machines, the server dies without further notification. It is always the same eventlog that causes the death of Zabbix:

002912:20070111:003532 Query::select hostid from hosts where host='that the sour
ce domain controller is running Active directory and
is accessible on the network by typing "net view \\<source DC name>" or
"ping <source DC name>".



 3) Verify that the source domain controller is using a valid DNS server for
DNS services, and that the source domain controller's host record and CNAME
record are correctly registered, using the DNS Enhanced version
of DCDIAG.EXE available on http://www.microsoft.com/dns



  dcdiag /test:dns



 4) Verify that that this destination domain controller is using a valid DNS
server for DNS services, by running the DNS Enhanced version of DCDIAG.EXE
command on the console of the destination domain controller, as follows:



  dcdiag /test:dns



 5) For further analysis of DNS error failures see KB 824449:

   http://support.microsoft.com/?kbid=824449



Additional Data

Error value:

 11004 The requested name is valid, but no data of the requested type was found.


'
002912:20070111:003532 Query failed:You have an error in your SQL syntax.  Check
 the manual that corresponds to your MySQL server version for the right syntax t
o use near 's host record and CNAME
record are correctly registered, using [1064]
002891:20070111:003532 SNMP error [1]
002891:20070111:003532 Getting value of [lenvFirmVersion] from host [SWICTADBO00
70] failed
002891:20070111:003532 The value is not stored in database.
002792:20070111:003532 One server process died. Shutting down...
002792:20070111:003532 ZABBIX server is down.

I have searched the forum if anyone has had this before, but I couldn't easily find anything.

My guess is that the eventlog entry contains special characters that actually escape the MySQL syntax which causes the Zabbix server to die.

Has this been resolved in 1.1.4 or is there a workaround available that prevents the server from crashing after receiving such a log?

I think I could setup a bash script to run from cron that checkes the Zabbix log file for a crashed server and tries to restart it, but I would like to prevent a hack like that as it could get stuck in a loop.

Thanks in advance!

[abi]

hi,

ive had a windows host here which may have triggered the same problem,
the only solution was to disable monitoring for it (some weeks ago).

The zabbix server died as soon it received the hostname from the
windows agent (so its not related to the eventlog, though). Version
was 1.1.4 both agent and server.

[qix]

Perhaps the reason that Zabbix dies is because the string for the log is to long.
Does Zabbix do any checking of the input of the parameters it recieves from agents ? (lenght, format, illegal characters)

Abi, what was the hostname of the windows machine that caused this problem with you? Did it contain any special characters?

[qix]

I have turned off all the eventlog monitoring for my windows machines and have setup a simple script that checks if zabbix is running, and if not sends a email and restarts the server deamon.

I would however like to be able to monitor the eventlogs of our windows systems as they take up about 90% of our inventory.

Alexei, is this a bug in the way zabbix handles the data it receives from the client?