升级到 10.1.0 后停止向 syslog 服务器转发日志
6251
Created On 09/17/21 19:44 PM - Last Modified 05/31/25 03:27 AM
Symptom
- 系统日志-ng (更少的 mp-log syslog-ng ) 在 messages.log 中升级到 10.1.0 后每 2 分钟崩溃一次
CMS klogd: [ 378.155097] syslog-ng[10969]: segfault at 49 ip 00007fa7984f2880 sp 00007fa79683a4e0 error 4 in libcrypto.so.1.0.1e[7fa798332000+271000]
CMS klogd: [ 503.334900] syslog-ng[12251]: segfault at 49 ip 00007fa7984f2880 sp 00007fa79683a4e0 error 4 in libcrypto.so.1.0.1e[7fa798332000+271000]
CMS klogd: [ 633.716127] syslog-ng[12610]: segfault at 49 ip 00007fa7984f2880 sp 00007fa79683a4e0 error 4 in libcrypto.so.1.0.1e[7fa798332000+271000]
CMS klogd: [ 829.332002] syslog-ng[15179]: segfault at 49 ip 00007fa7984f2880 sp 00007fa79683a4e0 error 4 in libcrypto.so.1.0.1e[7fa798332000+271000]
CMS klogd: [ 959.780610] syslog-ng[15509]: segfault at 49 ip 00007fa7984f2880 sp 00007fa79683a4e0 error 4 in libcrypto.so.1.0.1e[7fa798332000+271000]
- Logd.log (少 mp 日志 logd.log )
Error: _pan_syslog(pan_syslog.c:806): Error calling syslog client
### [User admin logged in via Web from 10.47.223.240 using https], dgid 0, tplid 0
Error: syslog_clnt_send(syslog_clnt.c:348): SYSLOGCLNT(0x7f173b4afa38, 0x7f173b4afaf8, 28856, shut) Pkt dropped. syslog client not ready
Error: _pan_syslog(pan_syslog.c:806): Error calling syslog client
Error: syslog_clnt_send(syslog_clnt.c:348): SYSLOGCLNT(0x7f173b4afa38, 0x7f173b4afaf8, 28856, shut) Pkt dropped. syslog client not ready
Error: _pan_syslog(pan_syslog.c:806): Error calling syslog client
### [Connection to Update server: updates.paloaltonetworks.com completed successfully, initiated by 10.193.92.97], dgid 0, tplid 0
Error: syslog_clnt_send(syslog_clnt.c:348): SYSLOGCLNT(0x7f173b4afa38, 0x7f173b4afaf8, 28856, shut) Pkt dropped. syslog client not ready
Environment
- 帕洛阿尔托Firewall或者 Panorama
- PANOS：10.1
Cause
问题与OCSP检查导致 syslog-ng 崩溃的原因。
Resolution
放OCSP和CRL使用以下命令跳过：
- 验证当前设置OSCP和 CRL
> show system state | match cfg.syslogng-params
- 然后运行以下命令跳过
> set syslogng-ssl-conn-validation explicit CRL skip OCSP skip EKU skip
> set syslogng-ssl-conn-validation explicit OCSP skip CRL skip EKU skip
> configure
# commit force
- 确认OSCP和CRL现在设置为跳过
> show system state | match cfg.syslogng-params
- 确认 syslog-ng 不再崩溃并确认日志正在发送到 syslog 服务器并由 syslog 服务器接收