latest ntopng segfaulting

[nate-byrnes]

I just upgraded to 'ntopng Professional Edition v.3.3.180326' and now it seems ntopng will only run for a few hours before segfaulting. The only message I get is in dmesg:

[41821400.999000] ntopng[2359]: segfault at 30000000b ip 00007fbb63fdd196 sp 00007ffd64fb6a10 error 4 in libc-2.19.so[7fbb63f5e000+1be000]

What other info should I provide? I haven't upgraded for 6 months, and the prior version was running for that six months.

Here is my config file:

--interface=eth1
--interface=eth2
--interface=eth4
--interface=eth5
--disable-alerts=
--dns-mode=1
--local-networks="173.225.53.0/24,208.83.121.0/24,208.69.85.0/24,208.68.84.137/29,10.88.0.0/16,10.254.0.0/16"
--redis=localhost
#--dump-flows="es;ntopng;ntopng-%Y.%m.%d;http://lb.elmdc.com:9200/_bulk"
#--dump-flows=
--packet-filter="not host 10.88.29.18"
--dump-hosts=local
#--dump-aggregations=local
--sticky-hosts=local
#--communities=/etc/ntopng/communities.list

[emanuele-f]

Hi, if possible please run ntopng through the gdb debugger: you can do this by stopping ntopng with sudo systemctl stop ntopng and then run it with sudo gdb --args ntopng /etc/ntopng/ntopng.conf then type "run". After the crash, please send the stack trace with the bt gdb command

[nate-byrnes]

Here is the back trace: 03/Apr/2018 08:57:10 [Ntop.cpp:721] Adding fe80::215:17ff:fe9c:1136/128 as IPv6 interface address for eth5 03/Apr/2018 08:57:10 [Ntop.cpp:730] Adding fe80::215:17ff:fe9c:1136/64 as IPv6 local network for eth5 [New Thread 0x7fffe5ffb700 (LWP 10095)] [New Thread 0x7fffe57fa700 (LWP 10096)] 03/Apr/2018 08:57:10 [PeriodicActivities.cpp:59] Started periodic activities loop... [New Thread 0x7fffe4ff9700 (LWP 10097)] [Thread 0x7fffe4ff9700 (LWP 10097) exited] 03/Apr/2018 08:57:12 [PeriodicActivities.cpp:100] Each periodic activity script will use 4 threads [New Thread 0x7fffe4ff9700 (LWP 10098)] [New Thread 0x7fffc7fff700 (LWP 10099)] [New Thread 0x7fffc77fe700 (LWP 10100)] [New Thread 0x7fffc6ffd700 (LWP 10101)] [New Thread 0x7fffc67fc700 (LWP 10102)] [New Thread 0x7fffc5ffb700 (LWP 10103)] [New Thread 0x7fffc57fa700 (LWP 10104)] [New Thread 0x7fffc4ff9700 (LWP 10105)] [New Thread 0x7fffbffff700 (LWP 10106)] [New Thread 0x7fffbf7fe700 (LWP 10107)] [New Thread 0x7fffbeffd700 (LWP 10108)] [New Thread 0x7fffbe7fc700 (LWP 10109)] [New Thread 0x7fffbdffb700 (LWP 10110)] [New Thread 0x7fffbd7fa700 (LWP 10111)] [New Thread 0x7fffbcff9700 (LWP 10112)] [New Thread 0x7fffbc7f8700 (LWP 10113)] [New Thread 0x7fffbbff7700 (LWP 10114)] [New Thread 0x7fffbb7f6700 (LWP 10115)] [New Thread 0x7fffbaff5700 (LWP 10116)] [New Thread 0x7fffba7f4700 (LWP 10117)] [New Thread 0x7fffb9ff3700 (LWP 10118)] 03/Apr/2018 08:57:12 [NetworkInterface.cpp:2451] Started packet polling on interface eth1 [id: 4]... [New Thread 0x7fffb97f2700 (LWP 10119)] 03/Apr/2018 08:57:12 [NetworkInterface.cpp:2451] Started packet polling on interface eth2 [id: 5]... [New Thread 0x7fffb8ff1700 (LWP 10120)] 03/Apr/2018 08:57:12 [NetworkInterface.cpp:2451] Started packet polling on interface eth4 [id: 7]... [New Thread 0x7fffabfff700 (LWP 10121)] 03/Apr/2018 08:57:12 [NetworkInterface.cpp:2451] Started packet polling on interface eth5 [id: 11]... [New Thread 0x7fffab7fe700 (LWP 10122)] [Thread 0x7fffab7fe700 (LWP 10122) exited] *** Error in `/usr/local/bin/ntopng': double free or corruption (out): 0x00007fff4c000980 *** Program received signal SIGABRT, Aborted. [Switching to Thread 0x7fffc7fff700 (LWP 10099)] 0x00007ffff43f2c37 in raise () from /lib/x86_64-linux-gnu/libc.so.6 (gdb) bt #0 0x00007ffff43f2c37 in raise () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007ffff43f6028 in abort () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007ffff442f2a4 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #3 0x00007ffff443b82e in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #4 0x00000000004b5ba7 in Prefs::reloadPrefsFromRedis (this=0x883e00) at src/Prefs.cpp:555 #5 0x00000000004baae4 in Redis::checkDumpable (this=0x8846c0, key=0x7fffc7ffea20 "ntopng.prefs.iface_5.host_engaged_alert_counters") at src/Redis.cpp:204 #6 0x00000000004bcda6 in Redis::hashSet (this=0x8846c0, key=0x7fffc7ffea20 "ntopng.prefs.iface_5.host_engaged_alert_counters", field=0x7fffc7ffea60 "173.225.53.36@13", value=0x7fffc7ffea10 "1") at src/Redis.cpp:372 #7 0x00000000004167bc in AlertsManager::engageReleaseHostAlert (this=0x76452b0, host_ip=0x7fffc7ffec00 "173.225.53.36", host_vlan=13, alert_engine=alert_engine_periodic_1min, engaged_alert_id=0x4131a960 "flows_flood_attacker", alert_type=alert_flow_flood, alert_severity=alert_level_error, alert_json=0x4100f5a0 "Host <a href='/lua/host_details.lua?ifid=5&host=173.225.53.36@13'> epic1.cust.rooftopdata.com</a> is a Flooder (26 flows sent in 3 sec)", alert_origin=0x0, alert_target=0x0, engage=true) at src/AlertsManager.cpp:952 #8 0x00000000004a137f in AlertsManager::engageHostAlert (this=0x76452b0, host_ip=0x7fffc7ffec00 "173.225.53.36", host_vlan=13, alert_engine=alert_engine_periodic_1min, engaged_alert_id=0x4131a960 "flows_flood_attacker", alert_type=alert_flow_flood, alert_severity=alert_level_error, alert_json=0x4100f5a0 "Host <a href='/lua/host_details.lua?ifid=5&host=173.225.53.36@13'> epic1.cust.rooftopdata.com</a> is a Flooder (26 flows sent in 3 sec)") at /home/deri/ntopng/include/AlertsManager.h:114 #9 0x00000000004a03e1 in NetworkInterface::engageReleaseHostAlert (this=0x1759b30, allowed_networks=0x0, host_ip=0x7fffc7ffec00 "173.225.53.36", host_vlan=13, engage=true, alert_engine=alert_engine_periodic_1min, engaged_alert_id=0x4131a960 "flows_flood_attacker", alert_type=alert_flow_flood, alert_severity=alert_level_error, alert_json=0x4100f5a0 "Host <a href='/lua/host_details.lua?ifid=5&host=173.225.53.36@13'> epic1.cust.rooftopdata.com</a> is a Flooder (26 flows sent in 3 sec)") at src/NetworkInterface.cpp:6693 #10 0x0000000000474e92 in ntop_interface_engage_release_host_alert (vm=0x40df7378, engage=true) at src/Lua.cpp:6224 #11 0x0000000000475426 in ntop_interface_engage_host_alert (vm=0x40df7378) at src/Lua.cpp:6331 #12 0x0000000000542817 in lj_BC_FUNCC () #13 0x0000000000531ccd in lua_pcall () #14 0x00000000004e4b2d in LuaHandler::luaL_dofileM (this=0x7fff800172b0, execute=true) at pro/LuaHandler.cpp:34 #15 0x0000000000476820 in __ntop_lua_handlefile (L=0x40df7378, script_path=0x7fff880009b0 "/usr/share/ntopng/scripts/callbacks/interface/minute.lua", ex=true) at src/Lua.cpp:6757 #16 0x0000000000477730 in Lua::run_script (this=0x7fff800097d0, script_path=0x7fff880009b0 "/usr/share/ntopng/scripts/callbacks/interface/minute.lua", iface=0x1759b30) at src/Lua.cpp:7430 #17 0x00000000004c7525 in ThreadedActivity::runScript (this=0x91b0300, script_path=0x7fff880009b0 "/usr/share/ntopng/scripts/callbacks/interface/minute.lua", iface=0x1759b30) at src/ThreadedActivity.cpp:154 #18 0x00000000004c7ec5 in ThreadPool::run (this=0x91b0360) at src/ThreadPool.cpp:92 #19 0x00000000004c7c08 in doRun (ptr=0x91b0360) at src/ThreadPool.cpp:29 #20 0x00007ffff6b2e184 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #21 0x00007ffff44b9ffd in clone () from /lib/x86_64-linux-gnu/libc.so.6

…

On Tue, Apr 3, 2018 at 3:54 AM, Emanuele Faranda ***@***.***> wrote: Hi, if possible please run ntopng through the gdb debugger: you can do this by stopping ntopng with sudo systemctl stop ntopng and then run it with sudo gdb --args ntopng /etc/ntopng/ntopng.conf then type "run". After the crash, please send the stack trace with the bt gdb command — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1725 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ASdA8C2kON44A9Ym8i4LUvyx3STp3mQQks5tkyqsgaJpZM4TCLjs> .