beta4 crashing

[opb1978]

We have upgraded from beta2 to beta4 and receiving this error now:

2015-10-29T23:03:18.249227+01:00 yesss-proda1-db01 /usr/bin/packetbeat[38501]: log.go:114: Stacktrace:
/go/src/github.com/elastic/packetbeat/Godeps/_workspace/src/github.com/elastic/libbeat/logp/log.go:114 (0x4c20b6)
/usr/local/go/src/runtime/asm_amd64.s:437 (0x47d60e)
/usr/local/go/src/runtime/panic.go:423 (0x44d209)
/usr/local/go/src/runtime/panic.go:18 (0x44b749)
/go/src/github.com/elastic/packetbeat/protos/pgsql/pgsql.go:279 (0x510ff3)
/go/src/github.com/elastic/packetbeat/protos/pgsql/pgsql.go:610 (0x5134ce)
/go/src/github.com/elastic/packetbeat/protos/pgsql/pgsql.go:707 (0x513f4d)
/go/src/github.com/elastic/packetbeat/protos/tcp/tcp.go:87 (0x51fa03)
/go/src/github.com/elastic/packetbeat/protos/tcp/tcp.go:173 (0x520b3d)
/go/src/github.com/elastic/packetbeat/decoder/decoder.go:136 (0x6c5151)
/go/src/github.com/elastic/packetbeat/sniffer/sniffer.go:352 (0x532119)
/go/src/github.com/elastic/packetbeat/packetbeat.go:212 (0x422e0b)
/usr/local/go/src/runtime/asm_amd64.s:1696 (0x47f951)

we are using elasticsearch for output

If you need any more testing please let me know

[opb1978]

still having the same bug with the latest RC Package. If you need any more Informations please let me know!

[andrewkroh]

Would it be possible to run packetbeat with the -dump some/dir/captured-data.pcap command line option and send me the capture? If so, you can email it to me at [redacted].

I will then replay the capture file through packetbeat to recreate crash, develop a test case and a fix. I run something like this to replay the file through: packetbeat -c packetbeat.yml -e -v -d "pgsql" -t -I some/dir/captured-data.pcap -waitstop 30

[andrewkroh]

Thanks for sending the PCAP. I was able to reproduce the stack trace. So I will start debugging it. :)

./packetbeat -c ~/Downloads/issue-342/packetbeat.yml -e -v -d 'pgsql' -waitstop 30 -N -t -I ~/Downloads/issue-342/captured-data1.pcap

2015/11/18 23:01:04.208333 log.go:113: ERR ParsePgsql exception. Recovering, but please report this: runtime error: slice bounds out of range.
2015/11/18 23:01:04.209314 log.go:114: ERR Stacktrace: /Users/akroh/go/src/github.com/elastic/packetbeat/Godeps/_workspace/src/github.com/elastic/libbeat/logp/log.go:114 (0x406d416)
    Recover: Err("Stacktrace: %s", debug.Stack())
/usr/local/go/src/runtime/asm_amd64.s:437 (0x405e60e)
/usr/local/go/src/runtime/panic.go:423 (0x402f229)
/usr/local/go/src/runtime/panic.go:18 (0x402d769)
/Users/akroh/go/src/github.com/elastic/packetbeat/protos/pgsql/pgsql.go:279 (0x40f2d73)
    (*Pgsql).pgsqlRowsParser: column_value = s.data[s.parseOffset : s.parseOffset+int(column_length)]
/Users/akroh/go/src/github.com/elastic/packetbeat/protos/pgsql/pgsql.go:610 (0x40f524e)
    (*Pgsql).pgsqlMessageParser: pgsql.pgsqlRowsParser(s)
/Users/akroh/go/src/github.com/elastic/packetbeat/protos/pgsql/pgsql.go:707 (0x40f5ccd)
    (*Pgsql).Parse: ok, complete := pgsql.pgsqlMessageParser(priv.Data[dir])
/Users/akroh/go/src/github.com/elastic/packetbeat/protos/tcp/tcp.go:87 (0x4101783)
    (*TcpStream).addPacket: stream.data = mod.Parse(pkt, &stream.tcptuple, original_dir, stream.data)
/Users/akroh/go/src/github.com/elastic/packetbeat/protos/tcp/tcp.go:173 (0x41028bd)
    (*Tcp).Process: stream.addPacket(pkt, tcphdr, original_dir)
/Users/akroh/go/src/github.com/elastic/packetbeat/decoder/decoder.go:136 (0x42a1b31)
    (*DecoderStruct).DecodePacketData: decoder.tcpProc.Process(&decoder.tcp, &packet)
/Users/akroh/go/src/github.com/elastic/packetbeat/sniffer/sniffer.go:352 (0x41137d9)
    (*SnifferSetup).Run: sniffer.Decoder.DecodePacketData(data, &ci)
/Users/akroh/go/src/github.com/elastic/packetbeat/packetbeat.go:212 (0x4004fbb)
    (*Packetbeat).Run.func1: err := pb.Sniff.Run()
/usr/local/go/src/runtime/asm_amd64.s:1696 (0x4060951)