http-analyze-2.4.4 - glibc detected *** corrupted double-linked list ***
(4. April 2009)
Prerequisite
Problem description
The following excerpt from an apache httpd log file (test_5l.log):
66.249.72.103 - - [01/Jan/2009:00:39:13 +0100] "GET /gallery/konzert79/Picture_1.html HTTP/1.1" 200 1232 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
78.137.163.133 - - [31/Dec/2008:23:39:23 +0000] "GET /robots.txt HTTP/1.1" 200 25 "-" "-"
78.137.163.133 - - [31/Dec/2008:23:39:23 +0000] "GET / HTTP/1.1" 200 2043 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20070308 Minefield/3.0a1"
78.137.163.133 - - [01/Jan/2009:00:39:23 +0100] "GET /images/1x1.gif HTTP/1.1" 200 61 "http://www.ciselant.de/" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20070308 Minefield/3.0a1"
78.137.163.133 - - [31/Dec/2008:23:39:23 +0000] "GET /images/ciselant.png HTTP/1.1" 200 18725 "http://www.ciselant.de/" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a1) Gecko/20070308 Minefield/3.0a1"
leads to an abort while running http-analyze-2.4.4
> http-analyze test_5l.log
*** glibc detected *** corrupted double-linked list: 0x080ef4d8 ***
*** glibc detected *** double free or corruption: 0x080ecbd8 ***
*** glibc detected *** double free or corruption: 0x080ecbd8 ***
The Problem is an unbalanced 'fclose(opf)' call in the method 'prMonStats()'.
Patch to solve the problem
The following patch (patch-http-analyze-2.4.4-unbalanced_flcose.txt)
moves the calls to 'htm_trailer(ofp()' and
'fclose(fp)' inside the same if clause where the
'efopen()' is called:
--- src/http-analyze.c_orig 2009-04-04 22:33:02.017208504 +0200
+++ src/http-analyze.c 2009-04-04 22:52:48.729800768 +0200
@@ -4737,10 +4737,10 @@
prTopList(ofp, top_min, topn_min, 2);
if (topn_sec > 0)
prTopList(ofp, top_sec, topn_sec, 3);
- }
- html_trailer(ofp);
- (void) fclose(ofp);
+ html_trailer(ofp);
+ (void) fclose(ofp);
+ }
/* the top files/sites lists */
if (lntab[FNAME_TOPFILES] || lntab[FNAME_TOPLFILES]) {
http-analyze-2.4.4 - disorder detection (5. April 2009)
Prerequisite
Problem description
Use same (disorderd) apache httpd log file (test_5l.log, or test_20l.log for a more complete Dec/Jan statistic) and run http-analyze-2.4.4 with '-v' comand
line option for verbose output:
> http-analyze -v test_5l.log
Generating full statistics in current directory
Reading data from `test_5l.log'
Best blocksize for I/O is set to 64 KB
Hmm, looks like Combined Logfile Format (DLF)
Start new period at 01/Jan/2009
NOTE: output files will be created in subdirectory `www2009'
Creating full statistics for January 2009
... processing URLs
... processing hostnames
... processing user agents
... no referrer URLs found
Total entries read: 1, processed: 1
Clear almost all counters at 01/Jan/2009
Start new period at 01/Dec/2008
[WARNING]: Disorder detected: the Top Hours/Minutes/Seconds may be inaccurate
NOTE: output files will be created in subdirectory `www2008'
Creating full statistics for December 2008
... processing URLs
... processing hostnames
... processing user agents
... no referrer URLs found
Total entries read: 2, processed: 2
Clear almost all counters at 31/Dec/2008
Start new period at 01/Jan/2009
Creating full statistics for January 2009
... processing URLs
... processing hostnames
... processing user agents
... processing referrer URLs
Total entries read: 1, processed: 1
Clear almost all counters at 01/Jan/2009
Start new period at 01/Dec/2008
Creating full statistics for December 2008
... processing URLs
... processing hostnames
... processing user agents
... processing referrer URLs
... updating `www2008/index.html': last report is for December 2008
Total entries read: 1, processed: 1
Statistics complete until 31/Dec/2008
Due to an incomplete disorder detection the statistic pages for December
2008 and January 2009 are created two times.
Patch to solve the problem
The following patch (patch-http-analyze-2.4.4-disorder_detection.txt)
fixes the compares for next month and disorder detection:
--- src/http-analyze.c_orig 2009-04-05 09:31:40.223311080 +0200
+++ src/http-analyze.c 2009-04-05 09:46:50.299958400 +0200
@@ -1724,7 +1724,7 @@
t.start.mday = 1; /* tick back to beginning of month */
}
mkdtab(&t.start);
- } else if (entry->tm.year > t.start.year || entry->tm.mon > t.start.mon) {
+ } else if (entry->tm.year > t.start.year || (entry->tm.year == t.start.year && entry->tm.mon > t.start.mon)) {
assert(monthly != 0);
insertTop(&cday, top_day, topn_day);
@@ -1814,8 +1814,9 @@
asec += tvs.tv_usec/TICKS_PMSEC;
}
#endif
- } else if (entry->tm.year < t.start.year ||
- entry->tm.mon < t.end.mon || entry->tm.mday < t.end.mday) {
+ } else if (entry->tm.year < t.end.year ||
+ (entry->tm.year == t.end.year && entry->tm.mon < t.end.mon) ||
+ (entry->tm.year == t.end.year && entry->tm.mon == t.end.mon && entry->tm.mday < t.end.mday)) {
if (monthly && verbose == 2)
(void) fputc('\n', stderr);
prmsg(1, GETMSG(119, "Disorder detected, skip entries from"
Reference output after patch applied:
> http-analyze -v test_5l.log
Generating full statistics in current directory
Reading data from `test_5l.log'
Best blocksize for I/O is set to 64 KB
Hmm, looks like Combined Logfile Format (DLF)
Start new period at 01/Jan/2009
[WARNING]: Disorder detected, skip entries from 31/Dec/2008 to 01/Jan/2009 (test_5l.log)
[WARNING]: Disorder detected, skip entries from 31/Dec/2008 to 01/Jan/2009 (test_5l.log)
NOTE: output files will be created in subdirectory `www2009'
No more hits since 01/Jan/2009
Creating full statistics for January 2009
... processing URLs
... processing hostnames
... processing user agents
... processing referrer URLs
Total entries read: 5, processed: 2
Skipped: 0 corrupt, 3 ignored, 0 empty, 0 invalid, 0 auth
Statistics complete until 31/Jan/2009
<< back to projects page
copyright © 2009 Peter Seiderer for www.ciselant.de