1 |
Hi, |
2 |
|
3 |
Logrotate has a very strange behavior on my grsec box : |
4 |
after reading the config files, there is a big lockup, logrotate does not |
5 |
start rotating the logs, and use 100% CPU. Here is the verbose output : |
6 |
|
7 |
=====================8<===================== |
8 |
# logrotate /etc/logrotate.conf -v |
9 |
reading config file /etc/logrotate.conf |
10 |
including /etc/logrotate.d |
11 |
reading config file acpid |
12 |
reading config info for /var/log/acpid |
13 |
reading config file apache2 |
14 |
reading config info for /var/log/apache2/*log |
15 |
reading config file fail2ban |
16 |
reading config info for /var/log/fail2ban.log |
17 |
reading config file samba |
18 |
reading config info for /var/log/samba/log |
19 |
reading config file syslog-ng |
20 |
reading config info |
21 |
for /var/log/syslog /var/log/auth.log /var/log/mail.err /var/log/cron.log |
22 |
/var/log/mail.log /var/log/messages /var/log/user.log /var/log/daemon.log |
23 |
/var/log/kern.log /var/log/imapd.log /var/log/grsec.log /var/log/iptables.log |
24 |
/var/log/rsync.log |
25 |
reading config info for /var/log/wtmp |
26 |
<HERE IS THE LOCKUP> |
27 |
=====================>8===================== |
28 |
|
29 |
The same logrotate config works well on my desktop (non hardened) box. |
30 |
Strace output of logrotate execution sounds quite strange to me. Seems |
31 |
logrotate loops for half an hour with this message : |
32 |
|
33 |
=====================8<===================== |
34 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
35 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
36 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
37 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
38 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
39 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
40 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
41 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
42 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
43 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
44 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
45 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
46 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
47 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
48 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
49 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
50 |
=====================>8===================== |
51 |
|
52 |
Do you have any idea of what could cause this strange behavior ? |
53 |
|
54 |
Some config infos : |
55 |
- using a vanilla 2.6.14.6 with grsec patch 2.1.8 |
56 |
- rbac is disabled for those tests |
57 |
- logrotate is 3.7.1-r2 |
58 |
- hardened profile hardened/x86/2.6 full ~x86 |
59 |
- CFLAGS : -march=pentium4 -O2 -mtune=pentium4 -fomit-frame-pointer -pipe |
60 |
|
61 |
Regards, |
62 |
-- |
63 |
Guillaume Castagnino |
64 |
guilc@×××××××.net / casta@×××××.info |
65 |
GnuPG/PGP key : |
66 |
http://wwwkeys.pgp.net:11371/pks/lookup?op=vindex&search=0x8AF468AF |
67 |
Fingerprint : CD52 FE40 9592 BA1E E89D 5FB6 820E 4742 8AF4 68AF |