ulogd syslogemu output garbage after kernel update (32 to 64bit)

ulogd syslogemu output garbage after kernel update (32 to 64bit)

[Fiedler Roman]

Hello list,

In short: Could 32-bit ulogd run on 64-bit kernel without failing?

Longer story: One of our machines runs on 32bit linux because 32bit code is smaller. Also the kernel was a 32-bit one. Over the time during operation, the larger amount of data processed increased RAM requirements. All processes stay below 4G but the system itself could use more than 4G RAM, which is not possible with the 32-bit kernel used. So the kernel was upgraded  to 64 bit (kernel 3.3.2) WITHOUT upgrading the system to 64 bit.

Afterwards everything worked fine except that the ulogd (1.24-3ubuntu1) messages written to syslogemu were complete garbage, e.g.

Jan  1 00:00:00 localhost  0 0 20 0 1 < IN= [unprintable bytes]
R OUT= [unprintable bytes] MAC=50:54:2d:49:4e:46:4f:00:00:00:00:00:00:00:00:00:00:00:00:0e:00:50:56:9c:3c:a6:00:50:56:9c:00:a2:08:00:34:35:37:36:36:31:32:20:34:32:38:37:38:35:39:38:34:30:20:34:32:38:37:38:35:38:31:30:34:20:34:31:35:31:32  SRC=32.48.32.48 DST=32.49.55.32 LEN=13112 TOS=10 PREC=0x20 TTL=57 ID=12340 MF FRAG:5940 PROTO=53

All other iptables tools seem to work correctly, e.g. iptables-save shows correct interface names, rules and also the ruleset works as expected. From that I would expect, that the error should reside in the netlink handover of captured packets to ulogd or the ulogd handling of those messages.

Is it possible to run a 32-bit ulogd on 64-bit system or is there some reason, this cannot work? If it won't work, it would be nice if ulogd fails to start with some understandable error message.

Kind Regards,
Roman

DI Roman Fiedler
Engineer
Safety & Security Department
Assistive Healthcare Information Technology

AIT Austrian Institute of Technology GmbH
Reininghausstrae 13/1  |  8020 Graz  |  Austria
T +43(0) 50550 2957  |  M +43(0) 664 8561599  |  F +43(0) 50550 2950
roman.fiedler@ait.ac.at | http://www.ait.ac.at/

FN: 115980 i HG Wien  |  UID: ATU14703506
This email and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient, please notify the sender by return e-mail or by telephone and delete this message from your system and any printout thereof. Any unauthorized use, reproduction, or dissemination of this message is strictly prohibited. Please note that e-mails are susceptible to change. AIT Austrian Institute of Technology GmbH shall not be liable for the improper or incomplete transmission of the information contained in this communication, nor shall it be liable for any delay in its receipt.

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

AW: ulogd syslogemu output garbage after kernel update (32 to 64bit)

[Fiedler Roman]

> -----Ursprüngliche Nachricht-----
> Von: Fiedler Roman
> Gesendet: Montag, 10. September 2012 08:37
> An: netfilter-devel@vger.kernel.org
> Betreff: ulogd syslogemu output garbage after kernel update (32 to 64bit)
> 
> Hello list,
> 
> In short: Could 32-bit ulogd run on 64-bit kernel without failing?

Has any one an educated guess, if that could work? Are netlink data-structures machine-arch dependent and hence a 32-bit ulogd cannot process a 64-bit netlink message?
 
> Longer story: One of our machines runs on 32bit linux because 32bit code is
> smaller. Also the kernel was a 32-bit one. Over the time during operation, the
> larger amount of data processed increased RAM requirements. All processes
> stay below 4G but the system itself could use more than 4G RAM, which is not
> possible with the 32-bit kernel used. So the kernel was upgraded  to 64 bit
> (kernel 3.3.2) WITHOUT upgrading the system to 64 bit.
> 
> Afterwards everything worked fine except that the ulogd (1.24-3ubuntu1)
> messages written to syslogemu were complete garbage, e.g.
> 
> Jan  1 00:00:00 localhost  0 0 20 0 1 < IN= [unprintable bytes]
> R OUT= [unprintable bytes]
> MAC=50:54:2d:49:4e:46:4f:00:00:00:00:00:00:00:00:00:00:00:00:0e:00:5
> 0:56:9c:3c:a6:00:50:56:9c:00:a2:08:00:34:35:37:36:36:31:32:20:34:32:38:
> 37:38:35:39:38:34:30:20:34:32:38:37:38:35:38:31:30:34:20:34:31:35:31:3
> 2  SRC=32.48.32.48 DST=32.49.55.32 LEN=13112 TOS=10 PREC=0x20 TTL=57
> ID=12340 MF FRAG:5940 PROTO=53
> 
> All other iptables tools seem to work correctly, e.g. iptables-save shows
> correct interface names, rules and also the ruleset works as expected. From
> that I would expect, that the error should reside in the netlink handover of
> captured packets to ulogd or the ulogd handling of those messages.
> 
> Is it possible to run a 32-bit ulogd on 64-bit system or is there some reason,
> this cannot work? If it won't work, it would be nice if ulogd fails to start with
> some understandable error message.
> 
> Kind Regards,
> Roman

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: AW: ulogd syslogemu output garbage after kernel update (32 to 64bit)

[Jozsef Kadlecsik]

On Thu, 13 Sep 2012, Fiedler Roman wrote:

> > In short: Could 32-bit ulogd run on 64-bit kernel without failing?
> 
> Has any one an educated guess, if that could work? Are netlink 
> data-structures machine-arch dependent and hence a 32-bit ulogd cannot 
> process a 64-bit netlink message?
>  
> > Longer story: One of our machines runs on 32bit linux because 32bit code is
> > smaller. Also the kernel was a 32-bit one. Over the time during operation, the
> > larger amount of data processed increased RAM requirements. All processes
> > stay below 4G but the system itself could use more than 4G RAM, which is not
> > possible with the 32-bit kernel used. So the kernel was upgraded  to 64 bit
> > (kernel 3.3.2) WITHOUT upgrading the system to 64 bit.
> > 
> > Afterwards everything worked fine except that the ulogd (1.24-3ubuntu1)
> > messages written to syslogemu were complete garbage, e.g.

As far as I know, the development is concentrated on ulogd2. You are much 
better off by installing it manually.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary

Re: ulogd syslogemu output garbage after kernel update (32 to 64bit)

[Pablo Neira Ayuso]

On Thu, Sep 13, 2012 at 09:42:24AM +0200, Fiedler Roman wrote:
> > -----Ursprüngliche Nachricht-----
> > Von: Fiedler Roman
> > Gesendet: Montag, 10. September 2012 08:37
> > An: netfilter-devel@vger.kernel.org
> > Betreff: ulogd syslogemu output garbage after kernel update (32 to 64bit)
> > 
> > Hello list,
> > 
> > In short: Could 32-bit ulogd run on 64-bit kernel without failing?
> 
> Has any one an educated guess, if that could work? Are netlink data-structures machine-arch dependent and hence a 32-bit ulogd cannot process a 64-bit netlink message?

Netlink is aligned to 32-bits, no matter if arch is 32-bits/64-bits.
So the short answer is yes, it should work.

You'll have to debug this issue further if you want us to help.

Moreover, as Jozsef mentioned, we're targeting to ulogd2. Consider
that ulogd has entered EOL.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html