Bug 74924 – ulogd cant handle logfiles larger than 2 GB, suggestion for correction attached

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Lasse B. Jensen 2004-12-19 03:54:59 UTC]

ulogd cant handle logfiles larger than 2 GB, when filesize of the logfile reaches 2GB the daemon stop logging with no warning.

A fix to the problem is to apply the -D_FILE_OFFSET_BITS=64 gcc flag when compiling. I works on my platform and should work on others.





Reproducible: Always
Steps to Reproduce:
1. Start ulogd using ulogd_LOGEMU plugin log to a file
2. log things via ulog to ulogd in iptables
3. when filesize reaches 2 GB ulogd closes with no warning just stops

Actual Results:  
Logfile isnt complete several hours of log is missing. 

Expected Results:  
Logged everything

Portage 2.0.51-r3 (default-linux/x86/2004.2, gcc-3.3.4, glibc-2.3.4.20040808-r1,
2.6.9-gentoo-r1y i686)
=================================================================
System uname: 2.6.9-gentoo-r1y i686 Intel(R) Xeon(TM) CPU 2.80GHz
Gentoo Base System version 1.4.16
Autoconf: sys-devel/autoconf-2.59-r5
Automake: sys-devel/automake-1.8.5-r1
Binutils: sys-devel/binutils-2.15.90.0.1.1-r3
Headers:  sys-kernel/linux-headers-2.4.21-r1
Libtools: sys-devel/libtool-1.5.2-r7
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CFLAGS="-O2 -march=pentium4 -fomit-frame-pointer -pipe"
CHOST="i686-pc-linux-gnu"
COMPILER=""
CONFIG_PROTECT="/etc /usr/X11R6/lib/X11/xkb /usr/kde/2/share/config
/usr/kde/3/share/config /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=pentium4 -fomit-frame-pointer -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoaddcvs autoconfig ccache distlocks sandbox sfperms"
GENTOO_MIRRORS="http://mirror.uni-c.dk/gentoo/"
MAKEOPTS="-j5"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY=""
SYNC="rsync://rsync.de.gentoo.org/gentoo-portage"
USE="apache2 apm arts avi berkdb bitmap-fonts crypt cups encode f77 foomaticdb
fortran gd gdbm gif gpm imap imlib java jpeg junit libg++ libwww mad mikmod
motif mpeg mysql ncurses nls oggvorbis oss pam pdflib perl png python qt
quicktime readline sdl slang snmp spell sse ssl svga tcpd threads tiff truetype
x86 xml2 xmms xv zlib"

[Comment 1 Lasse B. Jensen 2004-12-19 03:56:56 UTC]

Offcourse this is with ebuild app-admin/ulogd/ulogd-1.02.ebuild i have problems ;)

[Comment 2 Daniel Ahlberg (RETIRED) 2005-01-01 11:09:24 UTC]

Added to CVS, thanks!

[Comment 3 Lasse B. Jensen 2005-01-07 12:43:59 UTC]

The new 1.02-r1 doesnt work yet.

The compile flags has to be added in both extensions/Makefile and Makefile

its missing i extension/Makefile i think

[Comment 4 Lasse B. Jensen 2005-01-07 12:52:24 UTC]

It has to be done such that the changes will be in Rules.make after configure script has been running.
 
emerge 
CFLAGS=-O2 -march=pentium4 -fomit-frame-pointer -pipe
CFLAGS+=-DULOGD_CONFIGFILE=\"$(ULOGD_CONFIGFILE)\"

compiling myself with manual addition of 
CFLAGS=-O2 
CFLAGS+=-DULOGD_CONFIGFILE=\"$(ULOGD_CONFIGFILE)\"

adding -D_FILE_OFFSET_BITS=64

CFLAGS=-O2 -D_FILE_OFFSET_BITS=64
CFLAGS+=-DULOGD_CONFIGFILE=\"$(ULOGD_CONFIGFILE)\"

then ulogd works because Rules.make is included in extensions/Makefile

[Comment 5 Daniel Ahlberg (RETIRED) 2005-01-07 13:08:21 UTC]

doh, I forgot to inherit flag-o-matic that makes append-flags work.

[Comment 6 Lasse B. Jensen 2005-01-07 13:28:48 UTC]

I test it as soon its in portage will it be 1.02-r2?