Bug 533050

Summary:	abrtd brought my system to a standstill by flooding syslog
Product:	[Fedora] Fedora	Reporter:	Lennart Poettering <lpoetter>
Component:	abrt	Assignee:	Jiri Moskovcak <jmoskovc>
Status:	CLOSED WONTFIX	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	rawhide	CC:	anton, dfediuck, dvlasenk, iprikryl, jmoskovc, kklic, mnowak, npajkovs
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-01-29 13:19:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	473302

Description Lennart Poettering 2009-11-04 20:02:29 UTC

abrtd for some reason started to flood my syslog with these two messages:

Nov  3 23:55:19 omega abrtd: Hmm, stray warn_client: 'RunAction(): CPluginManager::GetAction():Action plugin: 'KerneloopsScanner' is not registered.'
Nov  3 23:55:19 omega abrtd: Hmm, stray update_client: 'Execution of 'KerneloopsScanner' was not successful: CPluginManager::GetAction():Action plugin: 'KerneloopsScanner' is not registered.'

This caused /var/run to run full, at which point not much worked anymore, big disaster ensued.

This must not happen. abrtd *must* employ rate limiting for everything it logs!

Comment 1 Lennart Poettering 2009-11-04 20:11:12 UTC

/var of course ran full (via /var/log), not /var/run. Sorry for the confusion.

Comment 2 Denys Vlasenko 2009-11-05 11:37:40 UTC

You did not install KerneloopsScanner abrt plugin, but have it enabled in /etc/abrt/abrt.conf

How did you install abrt? "yum install abrt-<what exactly>"?

(This is the result of over-abundance of abrt rpms...)

Comment 3 Jiri Moskovcak 2009-11-05 12:44:57 UTC

ABRt shouldn't try to run the action plugins blindly and it should wanr about this failure only once, because if plugin isn't loaded than it will never succeed unless the plugin is installed and daemon restarted ...

And I don't agree that this a problem with too many rpms, it's a problem with badly designed config files.

Comment 4 Lennart Poettering 2009-11-05 16:35:50 UTC

(In reply to comment #2)
> You did not install KerneloopsScanner abrt plugin, but have it enabled in
> /etc/abrt/abrt.conf

I installed abrt quite some time ago and since then only upgraded. I haven't added the config files or anything.

> How did you install abrt? "yum install abrt-<what exactly>"?

No idea, that was months ago. And back then I didn't get syslog flooding.

Comment 5 Lennart Poettering 2009-11-05 16:36:11 UTC

s/added/edited

Comment 6 Lennart Poettering 2009-11-05 16:37:34 UTC

(In reply to comment #3)
> ABRt shouldn't try to run the action plugins blindly and it should wanr about
> this failure only once, because if plugin isn't loaded than it will never
> succeed unless the plugin is installed and daemon restarted ...

That is true.

> And I don't agree that this a problem with too many rpms, it's a problem with
> badly designed config files.  

That is true as well.

However, what is important is that abrtd also rate limits is syslog spew like any other sensible software.

Comment 7 Denys Vlasenko 2010-01-29 13:19:55 UTC

Closing the bug. Please reopen if you can reproduce this with abrt properly installed, that is: when abrt does not have configuration settings which require non-installed plugins.