IBM Support

IJ06633: SNMPD DAEMON CRASH OCCURS WHEN PERFORMING A WIDE QUERY

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • It has been identified that the snmpd daemon crashes (segfault)
    when performing a wide query.
    
    For Example:
    1) Start snmpd service
    systemctl start snmpd
    
    2) Execute a short query
    snmpwalk -v2c localhost:8001 -c public .1.3.6.1.2.1.2.2.1.2
    Result - returned as expected
    
    3) Execute wide query
    snmpwalk -v2c localhost:8001 -c public .1
    Result - Timeout: No Response from localhost:8001
    
    4) Upon checking the snmpd status:
    # systemctl status snmpd -l
    snmpd.service - Simple Network Management Protocol (SNMP)
    Daemon.
       Loaded: loaded (/usr/lib/systemd/system/snmpd.service;
    disabled; vendor preset: disabled)
      Drop-In: /etc/systemd/system/snmpd.service.d
              qradar.conf
       Active: failed (Result: signal) since Wed 2018-05-22
    18:17:33 ADT; 1min 7s ago
      Process: 2391 ExecStart=/usr/sbin/snmpd $OPTIONS -f
    (code=killed, signal=SEGV)
      Process: 2376
    ExecStartPre=/opt/qradar/snmpd/bin/snmpd_precheck.sh
    (code=exited, status=0/SUCCESS)
    Main PID: 2391 (code=killed, signal=SEGV)
    
    <date and timestamp> <hostname>  snmpd[2391]: Connection from
    UDP: [127.0.0.1]:59297->[127.0.0.1]:8001
    <date and timestamp> <hostname>  snmpd[2391]: Connection from
    UDP: [127.0.0.1]:59297->[127.0.0.1]:8001
    <date and timestamp> <hostname>  snmpd[2391]: Connection from
    UDP: [127.0.0.1]:59297->[127.0.0.1]:8001
    <date and timestamp> <hostname>  snmpd[2391]: Connection from
    UDP: [127.0.0.1]:59297->[127.0.0.1]:8001
    <date and timestamp> <hostname>  snmpd[2391]: Connection from
    UDP: [127.0.0.1]:59297->[127.0.0.1]:8001
    <date and timestamp> <hostname>  snmpd[2391]: Connection from
    UDP: [127.0.0.1]:59297->[127.0.0.1]:8001
    <date and timestamp> <hostname>  snmpd[2391]: Connection from
    UDP: [127.0.0.1]:59297->[127.0.0.1]:8001
    <date and timestamp> <hostname>  systemd[1]: snmpd.service:
    main process exited, code=killed, status=11/SEGV
    <date and timestamp> <hostname>  systemd[1]: Unit snmpd.service
    entered failed state.
    <date and timestamp> <hostname>  systemd[1]: snmpd.service
    failed.
    
    5) From /var/log/messages
    <date and timestamp> <hostname> kernel: snmpd[2391]: segfault
    at 0 ip 00007f2994c5f9fb sp 00007ffe69352b38 error 4 in
    libc-2.17.so[7f2994b2b000+1b7000]
    <date and timestamp> <hostname> kernel: [110470.076192]
    snmpd[2391]: segfault at 0 ip 00007f2994c5f9fb sp
    00007ffe69352b38 error 4 in libc-2.17.so[7f2994b2b000+1b7000]
    <date and timestamp> <hostname> systemd[1]: snmpd.service: main
    process exited, code=killed, status=11/SEGV
    <date and timestamp> <hostname> systemd[1]: Unit snmpd.service
    entered failed state.
    <date and timestamp> <hostname> systemd[1]: snmpd.service
    failed.
    

Local fix

  • No workaround available.
    

Problem summary

  • This issue was fixed in QRadar QRM QVM release of 731 patch 6.
    

Problem conclusion

  • This issue was fixed in QRadar QRM QVM release of 731 patch 6.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ06633

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    731

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-05-23

  • Closed date

    2018-09-18

  • Last modified date

    2018-09-18

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"731","Edition":""}]

Document Information

Modified date:
18 September 2018