new argus on the dev server

[Terry Burton]

On Tue, Oct 12, 2010 at 8:51 PM, Carter Bullard <carter at qosient.com> wrote:
> I did find something that could cause memory to grow inappropriately while debugging
> another problem.  I'm uploaded argus-3.0.3.18 later today tomorrow, so hold off on
> extensive testing until then.

Carter,

I've ran with this all day and things look fine. Thanks!

> I've fixed the priv's and the setuid() getgid() etc....  When you write out to a file, you will
> get the ownership of the new user specified with the "-u" option, so that if you rename/
> remove the file, argus will recreate the file with the new user's id.

Likewise, this works for me.

> Working on the segfault now.

Thanks again!


All the best,

Terry


> On Oct 11, 2010, at 12:01 PM, Terry Burton wrote:
>> On Fri, Oct 8, 2010 at 10:28 PM, Carter Bullard <carter at qosient.com> wrote:
>>> So I've run this thing over and over and over, and I'm not getting appreciable memory leaking.
>>> I ran 2GB of packets through it, and only lost 1.7Kbytes of buffers, and they are in initialization
>>> blocks, so I can't replicate your report.
>>>
>>> Did you grab the absolutely most recent version of argus-3.0.3.17?  Grab it again, and re-run
>>> your tests, if you think you grabbed an earlier version of 17.
>>>
>>> I'm deploying on a number of machines now, so I'll let it cook for a few days and see if I can
>>> see any loss, but so far nada.
>>
>> Hi Carter,
>>
>> I've compared md5sums and I'm definitely running the most recent
>> version of Argus. I'm hoping to find time to have a proper look into
>> this issue tomorrow afternoon.
>>
>> Whilst investigating I found a couple more nits that you might want to
>> look into before cutting a new release:
>>
>> When using argus-udp:// output, after running for a while on a
>> moderately system sendto() may return EAGAIN which is followed by a
>> segfault:
>>
>> Oct 11 15:07:48 oink argus[3457]: 11 Oct 10 15:07:48.827421
>> ArgusInitOutput: sendto(): retn -1 Resource temporarily unavailable
>> Oct 11 15:07:48 oink kernel: [1812219.298198] argus[3460]: segfault at
>> 90 ip 7fa9211db628 sp 41f378b0 error 4 in
>> libpthread-2.7.so[7fa9211d4000+16000]
>>
>> Running as a non-root user appears to be broken. When run as root
>> ArgusInitOutput sets both the uid and euid to "argus" so that there is
>> no way for ArgusInitSource to recover sufficient privilege to attach
>> to the pcap interface.
>>
>> # argus -u argus -X -J -R -Z -U 80 -m -M 60 -i eth1/1.2.3.4
>> argus[15373]: 11 Oct 10 15:43:19.905257 started
>> argus[15373]: 11 Oct 10 15:43:19.909257 ArgusOpenInterface:
>> pcap_open_livmake socket: Operation not permitted
>> Segmentation fault
>>
>>
>> Thanks,
>>
>> Terry
>>
>>
>>> On Oct 7, 2010, at 9:59 AM, Terry Burton wrote:
>>>> On Wed, Oct 6, 2010 at 6:50 PM,  <carter at qosient.com> wrote:
>>>>> 17 is attempting to deal with memory problems, so if we've got leaks, there is more work to do.
>>>>>
>>>>> Any chance you could run valgrind against argus on your system?
>>>>
>>>> Hi Cater,
>>>>
>>>> The output of a couple of successive valgrind runs is included below,
>>>> though I'm not sure that you will find them particularly illuminating
>>>> for this issue since they do not indicate much of a leak.
>>>>
>>>> I will continue to experiment as I find time.
>>>>
>>>>
>>>> Thanks,
>>>>
>>>> Terry