ossec-logcollector segfault on RHEL 8.10

[berangerc]

Hello,

I have a segmentation fault on ossec-logcollector process when trying to start it.
Here are some logs :

• From dmesg :

ossec-logcollec[9978]: segfault at 0 ip 00007f9ddde9a4d0 sp 00007ffe33cb7a68 error 4 in libc-2.28.so[7f9ddddb7000+1cd000]
Code: d2 0f 84 b7 0f 00 00 48 83 fa 01 0f 84 b9 0f 00 00 49 89 d3 89 f1 89 f8 48 83 e1 3f 48 83 e0 3f 83 f9 30 77 45 83 f8 30 77 40 <f3> 0f 6f 0f f3 0f 6f 16 66 0f ef c0 66 0f 74 c1 66 0f 74 ca 66 0f

• From strace :

$ strace -yy /tools/list/ossec/bin/ossec-logcollector -f
.....
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2971, ...}) = 0
openat(AT_FDCWD</tools/list/ossec/var/run>, "/tools/list/ossec/logs/ossec.log", O_WRONLY|O_CREAT|O_APPEND, 0666) = 5</tools/list/ossec/logs/ossec.log>
lseek(5</tools/list/ossec/logs/ossec.log>, 0, SEEK_END) = 177363
fstat(5</tools/list/ossec/logs/ossec.log>, {st_mode=S_IFREG|0644, st_size=177363, ...}) = 0
write(5</tools/list/ossec/logs/ossec.log>, "2024/12/20 14:37:30 ossec-logcol"..., 69) = 69
close(5</tools/list/ossec/logs/ossec.log>) = 0
write(2</dev/pts/1<char 136:1>>, "2024/12/20 14:37:30 ", 202024/12/20 14:37:30 ) = 20
write(2</dev/pts/1<char 136:1>>, "ossec-logcollector: INFO: Starte"..., 48ossec-logcollector: INFO: Started (pid: 140076).) = 48
write(2</dev/pts/1<char 136:1>>, "\n", 1
) = 1
select(0, NULL, NULL, NULL, {tv_sec=2, tv_usec=0}) = 0 (Timeout)
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
+++ killed by SIGSEGV (core dumped) +++
Segmentation fault (core dumped)

• ossec.conf file :

$ cat ossec.conf
<ossec_config>
  <client>
    <server-ip>192.168.0.1</server-ip>
    <config-profile>LINUX_PROD</config-profile>
  </client>
</ossec_config>

Someone has ever encountred this problem ?

[atomicturtle]

How did you build it? Maybe try the RPM packages to compare it and see if you get the same error with those as you did with this one

[berangerc]

Hello,

This package is deployed on hundred servers without any problem.
Only 2 servers concerned by this problem :-(

[atomicturtle]

That sounds like an environment issue on those systems then, whats unique about them?