[Bug 1158241] New: (systemd-journal) of user 0 dumped core
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241 Bug ID: 1158241 Summary: (systemd-journal) of user 0 dumped core Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening@forge.provo.novell.com Reporter: Ulrich.Windl@rz.uni-regensburg.de QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- It seems the machine was target of some distributed attack, and as a consequence systemd-journal seems to have crashed. I found these entries: Dec 02 12:49:57 pc systemd-coredump[21380]: Process 1726 (systemd-journal) of user 0 dumped core. Dec 02 12:49:57 pc systemd-coredump[21380]: Coredump diverted to /var/lib/systemd/coredump/core.systemd-journal.0.e2ee8dc29c0f4579a2f8ce0627b51f03.1726.15752872820... Dec 02 12:49:57 pc systemd-coredump[21380]: Stack trace of thread 1726: Dec 02 12:49:57 pc systemd-coredump[21380]: #0 0x00007f4cbaab9230 journal_file_find_data_object_with_hash (libsystemd-shared-234.so) Dec 02 12:49:57 pc systemd-coredump[21380]: #1 0x00007f4cbaab94bd n/a (libsystemd-shared-234.so) Dec 02 12:49:57 pc systemd-coredump[21380]: #2 0x00007f4cbaabb619 journal_file_append_entry (libsystemd-shared-234.so) Dec 02 12:49:57 pc systemd-coredump[21380]: #3 0x0000556185680f8d n/a (systemd-journald) Dec 02 12:49:57 pc systemd-coredump[21380]: #4 0x000055618568305f n/a (systemd-journald) Dec 02 12:49:57 pc systemd-coredump[21380]: #5 0x000055618567aed2 n/a (systemd-journald) Dec 02 12:49:57 pc systemd-coredump[21380]: #6 0x00007f4cbaa8eae8 n/a (libsystemd-shared-234.so) Dec 02 12:49:57 pc kernel: systemd-coredum: 5 output lines suppressed due to ratelimiting Dec 02 12:49:57 pc kernel: SFW2-INext-DROP-DEFLT IN=eth0 OUT= MAC=00:24:1d:d7:0b:17:bc:ea:fa:a4:79:00:08:00 SRC=92.53.104.212 DST=<IP> LEN=40 TOS=0x00 P... Dec 02 12:49:57 pc systemd-journald[21398]: Journal started Dec 02 12:49:57 pc systemd-journald[21398]: System journal (/var/log/journal/89c660865c00403a9bacef32b6828556) is 832.0M, max 819.2M, 0B free. Dec 02 12:48:02 pc systemd[1]: systemd-journald.service: Watchdog timeout (limit 3min)! Dec 02 12:48:02 pc systemd[1]: systemd-journald.service: Killing process 1726 (systemd-journal) with signal SIGABRT. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241#c2
--- Comment #2 from Ulrich Windl
Can you attach the core dump ?
"coredumpctl list" does not show one: TIME PID UID GID SIG COREFILE EXE Thu 2019-03-07 08:15:18 CET 7874 1000 100 11 missing /usr/bin/seahorse Wed 2019-03-27 12:21:57 CET 3640 1000 100 5 none /usr/lib/gnome-settings-daemon-3.0/gnome-settings-daemon Mon 2019-05-20 08:08:08 CEST 25020 1000 100 11 none /usr/lib64/firefox/firefox Mon 2019-05-20 08:08:12 CEST 24446 1000 100 11 none /usr/lib64/firefox/firefox Mon 2019-05-20 08:08:14 CEST 26997 1000 100 11 none /usr/lib64/firefox/firefox Wed 2019-05-29 11:22:24 CEST 21708 1000 100 11 missing /usr/bin/seahorse Thu 2019-08-22 13:17:24 CEST 9017 1000 100 5 missing /usr/lib/telepathy-haze Tue 2019-11-05 10:12:42 CET 4620 1000 100 11 missing /usr/lib64/firefox/firefox
Also please provide the version of systemd (rpm -q systemd).
systemd-234-lp151.26.4.1.x86_64 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241#c3
--- Comment #3 from Franck Bui
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241#c4
Franck Bui
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
Franck Bui
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241#c5
Ulrich Windl
Can you find something in /var/lib/systemd/coredump ?
Yes, I have two of them, and the first one seems to match: total 628 -rw-r----- 1 root root 336677 Dec 2 12:49 core.systemd-journal.0.e2ee8dc29c0f4579a2f8ce0627b51f03.1726.1575287282000000.lz4 -rw-r----- 1 root root 300826 Dec 4 08:48 core.systemd-journal.0.e2ee8dc29c0f4579a2f8ce0627b51f03.21398.1575445623000000.lz4 And for the second core-dump the events looked like this: (The system was up for quite a while then) Dec 04 08:48:46 pc systemd-journald[27776]: Journal started Dec 04 08:48:46 pc systemd-journald[27776]: System journal (/var/log/journal/89c660865c00403a9bacef32b6828556) is 840.0M, max 819.2M, 0B free. ... Dec 04 08:48:46 pc systemd-coredump[27757]: Process 21398 (systemd-journal) of user 0 dumped core. Dec 04 08:48:46 pc systemd-coredump[27757]: Coredump diverted to /var/lib/systemd/coredump/core.systemd-journal.0.e2ee8dc29c0f4579a2f8ce0627b51f03.21398.1575445623000000.l> Dec 04 08:48:46 pc systemd-coredump[27757]: Stack trace of thread 21398: Dec 04 08:48:46 pc systemd-coredump[27757]: #0 0x00007f2260b49750 n/a (libsystemd-shared-234.so) Dec 04 08:48:46 pc systemd-coredump[27757]: #1 0x00007f2260b4b619 journal_file_append_entry (libsystemd-shared-234.so) Dec 04 08:48:46 pc systemd-coredump[27757]: #2 0x0000560b8230df8d n/a (systemd-journald) Dec 04 08:48:46 pc systemd-coredump[27757]: #3 0x0000560b8231005f n/a (systemd-journald) Dec 04 08:48:46 pc systemd-coredump[27757]: #4 0x0000560b82307ed2 n/a (systemd-journald) Dec 04 08:48:46 pc systemd-coredump[27757]: #5 0x00007f2260b1eae8 n/a (libsystemd-shared-234.so) Dec 04 08:48:46 pc systemd-coredump[27757]: #6 0x00007f2260b20222 sd_event_dispatch (libsystemd-shared-234.so) Dec 04 08:48:46 pc kernel: systemd-coredum: 4 output lines suppressed due to ratelimiting Dec 04 08:48:46 pc packagekitd[27495]: DownloadProgressReportReceiver::start():http://download.opensuse.org/update/leap/15.1/oss/ --libarchive13;3.3.2-lp151.5.3.1;x86_64;r> Dec 04 08:47:02 pc systemd[1]: systemd-journald.service: Watchdog timeout (limit 3min)! Dec 04 08:47:02 pc systemd[1]: systemd-journald.service: Killing process 21398 (systemd-journal) with signal SIGABRT. Dec 04 08:48:46 pc systemd[1]: Starting Flush Journal to Persistent Storage... Dec 04 08:48:46 pc systemd[1]: Started Flush Journal to Persistent Storage. ... -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241#c6
--- Comment #6 from Ulrich Windl
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241#c7
--- Comment #7 from Franck Bui
Dec 02 12:42:52 pc smartd[2275]: Device: /dev/sda [SAT], self-test in progress, 10% remaining
You can increase the watchdog timeout to make it more permissive to such scenario. See https://bugzilla.redhat.com/show_bug.cgi?id=1300212 for a similar report. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
Franck Bui
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241#c8
--- Comment #8 from Ulrich Windl
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241#c9
Franck Bui
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241
http://bugzilla.opensuse.org/show_bug.cgi?id=1158241#c10
Ulrich Windl
From the user's perspective journald was killed while actually writing log messages, so the killing made no sense.
-- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@novell.com