Debian 12 / Perl 5.38 LFD not reading logs - *SOLUTION*

[Vark]

Hi,

Following investigation there is a change in Perl 5.38 which breaks LFD.

https://perldoc.perl.org/perldelta#read ... -eof-flags

As soon as one of the log files causes an error (e.g. is simply not present), all future log file reads on any file will fail until the error is cleared.

I solved this by adding a clearerr call before each log read, which is in the LFD file and the function getlogfile (around line 2195 for the function start).

I amended the code as follows:

Code: Select all

 if (!defined($lffd[$lfn]))  {
                if (&openlogfile($logfile,$lfn)) {return undef}
    }

    $lffd[$lfn]->clearerr(); # <-- THIS IS THE NEW LINE

    (undef, $ino, undef, undef, undef, undef, undef, $size, undef) = stat($logfile);

Now LFD reads the log files under Perl 5.38. Not sure if this has any side effects or might occur elsewhere, so use at your own risk.

[Vark]

Just to remind that you'd need to do this mod every time LFD updates until it's incorporated somehow into a release version. Anyone know how I flag this to the maintainers?

[alexf]

Re-Post your fix in "Report Bugs (csf)" portion of forum. That gets checked by the ConfigServer team.

[Vark]

Thanks - done.

[Vark]

Interested if anyone else has tested/tried this mod - whilst it appears that it is reading the files, it doesn't appear to be spotting port scans (it is spotting other things, so for example I get the SUDO usage alerts). I've had to set the files back to standard (not high-precision) logging, in rsyslogd.conf, to get that working.

I've not found where else I might be hitting issues as of yet. I've added debug output at various places over time with little luck. At least most of the rest of the functionality appears to work.

[Vark]

The clearerr fix is present in version 14.19