AnsweredAssumed Answered

cp_file_convert always coredump

Question asked by Peter Baumann on Jan 22, 2019
Latest reply on Jan 22, 2019 by Günther W. Albrecht

Hi all,

We're using Threat Prevention on a R80.10 VSX virtual system configured with MTA support.

The Threat Extraction is configured to convert to pdf in the policy, file types like docx, pps, xls etc. are according to profile converted to pdf then.

 

In the /var/log/messages we see many coredumps like these here:

 

kernel: do_coredump: argv_arr[1] = /var/log/dump/usermode/cp_file_convert.24156.core
kernel: cp_file_convert[14806]: segfault at 00000000000001a8 rip 00000000f6dc7129 rsp 00000000ffd471c4 error 4
kernel: do_coredump: corename = |/etc/coredump/compress.sh /var/log/dump/usermode/cp_file_convert.14806.core
kernel: do_coredump: argv_arr[0] = /etc/coredump/compress.sh
kernel: do_coredump: argv_arr[1] = /var/log/dump/usermode/cp_file_convert.14806.core
kernel: cp_file_convert[1235]: segfault at 00000000000001a8 rip 00000000f6d8c129 rsp 00000000ffb857f4 error 4
kernel: do_coredump: corename = |/etc/coredump/compress.sh /var/log/dump/usermode/cp_file_convert.1235.core
kernel: do_coredump: argv_arr[0] = /etc/coredump/compress.sh
kernel: do_coredump: argv_arr[1] = /var/log/dump/usermode/cp_file_convert.1235.core
kernel: cp_file_convert[10122]: segfault at 00000000000001a8 rip 00000000f6d63129 rsp 00000000ffec8174 error 4
kernel: do_coredump: corename = |/etc/coredump/compress.sh /var/log/dump/usermode/cp_file_convert.10122.core
kernel: do_coredump: argv_arr[0] = /etc/coredump/compress.sh
kernel: do_coredump: argv_arr[1] = /var/log/dump/usermode/cp_file_convert.10122.core
kernel: cp_file_convert[24497]: segfault at 00000000000001a8 rip 00000000f6d5f129 rsp 00000000ffe7c5b4 error 4
kernel: do_coredump: corename = |/etc/coredump/compress.sh /var/log/dump/usermode/cp_file_convert.24497.core
kernel: do_coredump: argv_arr[0] = /etc/coredump/compress.sh
kernel: do_coredump: argv_arr[1] = /var/log/dump/usermode/cp_file_convert.24497.core
kernel: cp_file_convert[15136]: segfault at 00000000000001a8 rip 00000000f6d9c129 rsp 00000000ffbe9b34 error 4
kernel: do_coredump: corename = |/etc/coredump/compress.sh /var/log/dump/usermode/cp_file_convert.15136.core
kernel: do_coredump: argv_arr[0] = /etc/coredump/compress.sh
kernel: do_coredump: argv_arr[1] = /var/log/dump/usermode/cp_file_convert.15136.core
kernel: cp_file_convert[5687]: segfault at 00000000000001a8 rip 00000000f6dd4129 rsp 00000000ffd0a414 error 4
kernel: do_coredump: corename = |/etc/coredump/compress.sh /var/log/dump/usermode/cp_file_convert.5687.core
kernel: do_coredump: argv_arr[0] = /etc/coredump/compress.sh
kernel: do_coredump: argv_arr[1] = /var/log/dump/usermode/cp_file_convert.5687.core

In /var/log/jail/$FWDIR/log/scrub_cp_file_convertd.elg we see the following:

 

 cp_file_convert_empty_tmp_oem_dir
cp_file_convert_main: starting mainloop (initialized by fwd)
cp_file_convert_urg_sig_handler: SIGPIPE received (ignored)

Has anyone with a similar config the same problems?

The whole system is running ok so far but why so many coredumps?

 

Thanks,

Peter

Outcomes