Module: check_mk Branch: master Commit: e3a221fc51ef1e468e5ac17d10fa1bb98e8a9fd6 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=e3a221fc51ef1e… Author: Sebastian Herbord <sh(a)mathias-kettner.de> Date: Mon Oct 12 13:41:35 2015 +0200 werk 2658 cherry picked --- .werks/2658 | 12 ++++++++++++ ChangeLog | 1 + checks/logwatch | 16 +++++++++++++++- 3 files changed, 28 insertions(+), 1 deletion(-) diff --git a/.werks/2658 b/.werks/2658 new file mode 100644 index 0000000..024a335 --- /dev/null +++ b/.werks/2658 @@ -0,0 +1,12 @@ +Title: logwatch: unacknowledged messages exceeding the max size are now dropped, even if they were already stored due to a previous bug +Level: 1 +Component: checks +Class: fix +Compatible: compat +State: unknown +Version: 1.2.7i3 +Date: 1444649368 + +A previous modification to the logwatch check caused the internal message buffer +(var/check_mk/logwatch) to become bloated, causing high cpu load and memory usage. +This change now auto-corrects those files for those affected. diff --git a/ChangeLog b/ChangeLog index f73bafc..6027ccf 100644 --- a/ChangeLog +++ b/ChangeLog @@ -219,6 +219,7 @@ * 2675 FIX: checkpoint_connections checkpoint_packets: Fixed wrong discovered services on non checkpoint devices * 2657 FIX: windows agent: fixed failure to resolve named performance counters... * 2676 FIX: cisco_asa_failover: Failover state is not treated as warning state anymore... + * 2658 FIX: logwatch: unacknowledged messages exceeding the max size are now dropped, even if they were already stored due to a previous bug... Multisite: * 2385 SEC: Fixed possible reflected XSS on all GUI pages where users can produce unhandled exceptions... diff --git a/checks/logwatch b/checks/logwatch index 39ed09d..65c7d98 100644 --- a/checks/logwatch +++ b/checks/logwatch @@ -339,6 +339,16 @@ check_info['logwatch.groups'] = { precompile_params['logwatch.groups'] = logwatch_group_precompile #. + +# truncate a file near the specified offset while keeping lines intact +def truncate_by_line(filename, offset): + f = open(filename, 'r+') + f.seek(offset) + f.readline() # ensures we don't cut inside a line + f.truncate() + f.close() + + def check_logwatch_generic(item, params, loglines, found, groups=False): # Create directories, if neccessary try: @@ -470,9 +480,13 @@ def check_logwatch_generic(item, params, loglines, found, groups=False): logwatch_file.seek(0) skip_reclassification = False - if skip_reclassification and os.path.getsize(logfile) > logwatch_max_filesize: + logfile_size = os.path.getsize(logfile) + if skip_reclassification and logfile_size > logwatch_max_filesize: # early out: without reclassification the file wont shrink and if it is already at # the maximum size, all input is dropped anyway + if logfile_size > logwatch_max_filesize * 2: + # if the file is far too large, truncate it + truncate_by_line(logfile, logwatch_max_filesize) return (2, "unacknowledged messages have exceeded max size, " "new messages are dropped (limit %d Bytes)" % logwatch_max_filesize)