Slice bounds out of range

Elastic Stack Beats
1

Hi all,

I'm running Packetbeat on an Ubuntu system with Postgres 9.2 and keep seeing the following in syslog:

Jan 13 15:43:24 cat-prod-pg92 /usr/bin/packetbeat[26499]: log.go:113: ParsePgsql exception. Recovering, but please report this: runtime error: slice bounds out of range.
Jan 13 15:43:24 cat-prod-pg92 /usr/bin/packetbeat[26499]: log.go:114: Stacktrace: /go/src/github.com/elastic/beats/libbeat/logp/log.go:114 (0x48c5c6)#012/usr/local/go/src/runtime/asm_amd64.s:437 (0x47d8fe)#012/usr/local/go/src/runtime/panic.go:423 (0x44d4f9)#012/usr/local/go/src/runtime/panic.go:18 (0x44ba39)#012/go/src/github.com/elastic/beats/packetbeat/protos/pgsql/pgsql.go:279 (0x512203)#012/go/src/github.com/elastic/beats/packetbeat/protos/pgsql/pgsql.go:610 (0x5146de)#012/go/src/github.com/elastic/beats/packetbeat/protos/pgsql/pgsql.go:707 (0x51515d)#012/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:87 (0x521093)#012/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:173 (0x5221cd)#012/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:136 (0x6c8ad1)#012/go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:352 (0x5337a9)#012/go/src/github.com/elastic/beats/packetbeat/packetbeat.go:212 (0x422f2b)#012/usr/local/go/src/runtime/asm_amd64.s:1696 (0x47fc41)

I've added the snaplen setting as per ParsePgsql exception (slice bounds out of range) · Issue #157 · elastic/beats · GitHub but this doesn't seem to help.

My packetbeat config is as follows:

interfaces:
device: any
snaplen: 65535
protocols:
pgsql:
ports: [5432]
output:
logstash:
enabled: true
hosts: ["dev-ingress1:10614", "dev-ingress2.10614"]
tls:
disabled: false
certificate_authorities: ["/etc/ssl/certs/dev-beats-ca.pem"]
insecure: false

Ubuntu 12.04.5
packetbeat 1.0.1
postgres 9.2.13-1.pgdg12.4+1

Any ideas about the cause of this and how I can solve it? Thanks!

2

We've some fixes in 1.1, but still unsure about problem being fixed or still persist. Any attempts to reproduce failed.

Can you try with packetbeat 1.1 nightlies: https://beats-nightlies.s3.amazonaws.com/index.html?prefix=packetbeat/

You can follow the issue on github:


3

Hi @steffens

I'm now running 1.2.0~nightly160112155654 with the same config, but still getting this error.

Is there any other info you want about the system?

4

Hi,

we're still trying to reproduce this problem for being able to debug and fix the issue. Unfortunately it's still hiding. We're still in need for a good trace.

See this github comment for a small shell script trying to capture and validate a trace reproducing the issue.

Please use github issue #565 for discussions, as we treat this as a bug.