how to solve this segmentation fault error dears

468 views
Skip to first unread message

ጥያቄህ ምንድን ነው

unread,
Jun 6, 2023, 2:46:41 AM6/6/23
to Wazuh mailing list
the full out put of during wazuh installation is this : Siem v4.4.3 (Rev. 40409) Installation Script - https://www.siem.com

 You are about to start the installation process of Siem.
 You must have a C compiler pre-installed in your system.

  - System: Linux siem 5.4.0-65-generic (ubuntu 20.04)
  - User: root
  - Host: siem


  -- Press ENTER to continue or Ctrl-C to abort. --


 - You already have Siem installed. Do you want to update it? (y/n): y

    - Installation will be made at  /var/ossec .

4- Installing the system

DIR="/var/ossec"
 - Running the Makefile

make siem-maild - siem-csyslogd - siem-agentlessd - siem-execd - siem-logcollector - siem-remoted siem-agentd manage_agents utils active-responses siem-syscheckd siem-monitord siem-reportd siem-authd siem-analysisd siem-logtest-legacy siem-dbd - siem-integratord siem-modulesd siem-db build_sysinfo build_shared_modules build_syscollector
make[1]: Entering directory '/root/siem-4.4.3/src'
make[1]: 'siem-maild' is up to date.
make[1]: 'siem-csyslogd' is up to date.
make[1]: 'siem-agentlessd' is up to date.
make[1]: 'siem-execd' is up to date.
make[1]: 'siem-logcollector' is up to date.
make[1]: 'siem-remoted' is up to date.
make[1]: 'siem-agentd' is up to date.
make[1]: 'manage_agents' is up to date.
make[1]: Nothing to be done for 'utils'.
make[1]: Nothing to be done for 'active-responses'.
make[1]: 'siem-syscheckd' is up to date.
make[1]: 'siem-monitord' is up to date.
make[1]: 'siem-reportd' is up to date.
make[1]: 'siem-authd' is up to date.
make[1]: 'siem-analysisd' is up to date.
make[1]: 'siem-logtest-legacy' is up to date.
make[1]: 'siem-dbd' is up to date.
make[1]: 'siem-integratord' is up to date.
make[1]: 'siem-modulesd' is up to date.
make[1]: 'siem-db' is up to date.
cd data_provider/ && mkdir -p build && cd build && cmake     .. && make
cd shared_modules/dbsync/ && mkdir -p build && cd build && cmake    .. && make
-- Configuring done
-- Configuring done
-- Generating done
-- Generating done
-- Build files have been written to: /root/siem-4.4.3/src/data_provider/build
-- Build files have been written to: /root/siem-4.4.3/src/shared_modules/dbsync/build
make[2]: Entering directory '/root/siem-4.4.3/src/data_provider/build'
make[2]: Entering directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
make[3]: Entering directory '/root/siem-4.4.3/src/data_provider/build'
make[3]: Entering directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
make[4]: Entering directory '/root/siem-4.4.3/src/data_provider/build'
make[4]: Entering directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
make[4]: Leaving directory '/root/siem-4.4.3/src/data_provider/build'
make[4]: Leaving directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
[ 84%] Built target sysinfo
[ 60%] Built target dbsync
make[4]: Entering directory '/root/siem-4.4.3/src/data_provider/build'
make[4]: Entering directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
make[4]: Entering directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
make[4]: Leaving directory '/root/siem-4.4.3/src/data_provider/build'
make[4]: Leaving directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
make[4]: Leaving directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
[ 80%] Built target dbsync_example
[100%] Built target dbsync_test_tool
[100%] Built target sysinfo_test_tool
make[3]: Leaving directory '/root/siem-4.4.3/src/data_provider/build'
make[3]: Leaving directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
make[2]: Leaving directory '/root/siem-4.4.3/src/data_provider/build'
make[2]: Leaving directory '/root/siem-4.4.3/src/shared_modules/dbsync/build'
cd shared_modules/rsync/ && mkdir -p build && cd build && cmake     .. && make
-- Configuring done

-- Generating done
-- Build files have been written to: /root/siem-4.4.3/src/shared_modules/rsync/build
make[2]: Entering directory '/root/siem-4.4.3/src/shared_modules/rsync/build'
make[3]: Entering directory '/root/siem-4.4.3/src/shared_modules/rsync/build'
make[4]: Entering directory '/root/siem-4.4.3/src/shared_modules/rsync/build'
make[4]: Leaving directory '/root/siem-4.4.3/src/shared_modules/rsync/build'
[ 37%] Built target rsync
make[4]: Entering directory '/root/siem-4.4.3/src/shared_modules/rsync/build'
make[4]: Leaving directory '/root/siem-4.4.3/src/shared_modules/rsync/build'
[100%] Built target rsync_test_tool
make[3]: Leaving directory '/root/siem-4.4.3/src/shared_modules/rsync/build'
make[2]: Leaving directory '/root/siem-4.4.3/src/shared_modules/rsync/build'
cd siem_modules/syscollector/ && mkdir -p build && cd build && cmake     .. && make
-- Configuring done
-- Generating done
-- Build files have been written to: /root/siem-4.4.3/src/siem_modules/syscollector/build
make[2]: Entering directory '/root/siem-4.4.3/src/siem_modules/syscollector/build'
make[3]: Entering directory '/root/siem-4.4.3/src/siem_modules/syscollector/build'
make[4]: Entering directory '/root/siem-4.4.3/src/siem_modules/syscollector/build'
make[4]: Leaving directory '/root/siem-4.4.3/src/siem_modules/syscollector/build'
[ 66%] Built target syscollector
make[4]: Entering directory '/root/siem-4.4.3/src/siem_modules/syscollector/build'
make[4]: Leaving directory '/root/siem-4.4.3/src/siem_modules/syscollector/build'
[100%] Built target syscollector_test_tool
make[3]: Leaving directory '/root/siem-4.4.3/src/siem_modules/syscollector/build'
make[2]: Leaving directory '/root/siem-4.4.3/src/siem_modules/syscollector/build'
make[1]: Leaving directory '/root/siem-4.4.3/src'
make settings
make[1]: Entering directory '/root/siem-4.4.3/src'

General settings:
    TARGET:             server
    V:                  
    DEBUG:              
    DEBUGAD            
    INSTALLDIR:         /var/ossec
    DATABASE:          
    ONEWAY:             no
    CLEANFULL:          no
    RESOURCES_URL:      https://packages.siem.com/deps/20
    EXTERNAL_SRC_ONLY:  
User settings:
    SIEM_GROUP:        siem
    SIEM_USER:         siem
USE settings:
    USE_ZEROMQ:         no
    USE_GEOIP:          no
    USE_PRELUDE:        no
    USE_INOTIFY:        no
    USE_BIG_ENDIAN:     no
    USE_SELINUX:        no
    USE_AUDIT:          yes
    DISABLE_SYSC:       no
    DISABLE_CISCAT:     no
    IMAGE_TRUST_CHECKS: 1
    CA_NAME:            DigiCert High Assurance EV Root CA
Mysql settings:
    includes:          
    libs:              
Pgsql settings:
    includes:          
    libs:              
Defines:
    -DOSSECHIDS -DUSER="siem" -DGROUPGLOBAL="siem" -DLinux -DINOTIFY_ENABLED -D_XOPEN_SOURCE=600 -D_GNU_SOURCE -DIMAGE_TRUST_CHECKS=1 -DCA_NAME='DigiCert High Assurance EV Root CA' -DENABLE_SYSC -DENABLE_CISCAT -DENABLE_AUDIT
Compiler:
    CFLAGS            -pthread -Iexternal/libdb/build_unix/ -Iexternal/pacman/lib/libalpm/ -Iexternal/libarchive/libarchive -Wl,--start-group -Iexternal/audit-userspace/lib -DNDEBUG -O2 -DOSSECHIDS -DUSER="siem" -DGROUPGLOBAL="siem" -DLinux -DINOTIFY_ENABLED -D_XOPEN_SOURCE=600 -D_GNU_SOURCE -DIMAGE_TRUST_CHECKS=1 -DCA_NAME='DigiCert High Assurance EV Root CA' -DENABLE_SYSC -DENABLE_CISCAT -DENABLE_AUDIT -pipe -Wall -Wextra -std=gnu99 -I./ -I./headers/ -Iexternal/openssl/include -Iexternal/cJSON/ -Iexternal/libyaml/include -Iexternal/curl/include -Iexternal/msgpack/include -Iexternal/bzip2/ -Ishared_modules/common -Ishared_modules/dbsync/include -Ishared_modules/rsync/include -Isiem_modules/syscollector/include  -Idata_provider/include  -Iexternal/libpcre2/include -Iexternal/rpm//builddir/output/include
    LDFLAGS           '-Wl,-rpath,/../lib' -pthread -lrt -ldl -O2 -Lshared_modules/dbsync/build/lib -Lshared_modules/rsync/build/lib  -Lsiem_modules/syscollector/build/lib -Ldata_provider/build/lib
    LIBS              -lrt -ldl -lm
    CC                gcc
    MAKE              make
make[1]: Leaving directory '/root/siem-4.4.3/src'

Done building server

Stopping Siem...
server
Wait for success...
success
Removing old SCA policies...
Installing SCA policies...
Installing additional SCA policies...
mkdir -p /var/ossec/framework/python
cp external/cpython.tar.gz /var/ossec/framework/python/cpython.tar.gz && tar -xf /var/ossec/framework/python/cpython.tar.gz -C /var/ossec/framework/python && rm -rf /var/ossec/framework/python/cpython.tar.gz
find /var/ossec/framework/python -name "*libpython3.9.so.1.0" -exec ln -f {} /var/ossec/lib/libpython3.9.so.1.0 \;
cd ../framework && /var/ossec/framework/python/bin/python3 setup.py clean --all install --prefix=/var/ossec/framework/python --siem-version=v4.4.3 --install-type=server
Segmentation fault (core dumped)
make: *** [Makefile:2238: install_framework] Error 139


Wait for success...
success
Searching for deprecated rules and decoders...
Starting Siem...
Job for siem-manager.service failed because the control process exited with error code.
See "systemctl status siem-manager.service" and "journalctl -xe" for details.

 - Configuration finished properly.

 - To start Siem:
      /var/ossec/bin/siem-control start

 - To stop Siem:
      /var/ossec/bin/siem-control stop

 - The configuration can be viewed or modified at /var/ossec/etc/ossec.conf


   Thanks for using Siem.
   Please don't hesitate to contact us if you need help or find
   any bugs.

   Use our public Mailing List at:
          https://groups.google.com/forum/#!forum/siem

   More information can be found at:
          - http://www.siem.com

    ---  Press ENTER to finish (maybe more information below). ---

Samson Olugbenga Idowu

unread,
Jun 6, 2023, 3:12:12 AM6/6/23
to Wazuh mailing list
Hello, this could be caused by a variety of factors, such as incompatible dependencies or hardware issues. We recommend checking the system logs and running a diagnostic test to identify the root cause of the issue. Additionally, it may be helpful to review the installation instructions and ensure that all prerequisites are met before attempting to install Siem again.

For starters, you can check using this command: `systemctl status siem-manager.service`

Our team is available to provide further assistance if needed.

ጥያቄህ ምንድን ነው

unread,
Jun 6, 2023, 3:27:50 AM6/6/23
to Wazuh mailing list
thank you samson ! the out put of systemctl status siem-manager.service is this and how to check  incompatible dependencies or hardware issues

● siem-manager.service - Siem manager
     Loaded: loaded (/etc/systemd/system/siem-manager.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Tue 2023-06-06 06:33:33 UTC; 52min ago
    Process: 578131 ExecStart=/usr/bin/env /var/ossec/bin/siem-control start (code=exited, status=1/FAILURE)

Jun 06 06:33:33 siem systemd[1]: Starting Siem manager...
Jun 06 06:33:33 siem env[578144]: Segmentation fault (core dumped)
Jun 06 06:33:33 siem env[578131]: siem-apid: Configuration error. Exiting
Jun 06 06:33:33 siem systemd[1]: siem-manager.service: Control process exited, code=exited, status=1/FAILURE
Jun 06 06:33:33 siem systemd[1]: siem-manager.service: Failed with result 'exit-code'.
Jun 06 06:33:33 siem systemd[1]: Failed to start Siem manager.

Samson Olugbenga Idowu

unread,
Jun 6, 2023, 4:07:55 AM6/6/23
to Wazuh mailing list
The error message "Segmentation fault (core dumped)" typically indicates a crash or memory-related issue.

Kindly provide details on your system resources such as RAM and processor cores.

Also, please try the below steps and revert with status as this is difficult to pin-point:

  • Ensure that your system meets all the necessary requirements for running the software or process you are trying to execute. Pay attention to the supported operating systems, libraries, dependencies, and hardware specifications.
  • Make sure that the installation files you are using are not corrupted or incomplete. If possible, try downloading them again from a reliable source.
  • Check if there are any dependencies required by the software or process you are working with. Ensure that you have the latest versions of these dependencies installed and that they are compatible with your system.
  • If possible, try running the same command or process on a different system with a similar configuration.

ጥያቄህ ምንድን ነው

unread,
Jun 6, 2023, 4:27:10 AM6/6/23
to Wazuh mailing list
my  system's RAM is               total        used        free      shared  buff/cache   available
Mem:           15Gi       471Mi       8.8Gi       1.0Mi       6.4Gi        14Gi
Swap:         2.0Gi          0B       2.0Gi and my  number of processor cores is 16 and detailed information about your CPU, including the number of cores Architecture:                    x86_64
CPU op-mode(s):                  32-bit, 64-bit
Byte Order:                      Little Endian
Address sizes:                   43 bits physical, 48 bits virtual
CPU(s):                          16
On-line CPU(s) list:             0-15
Thread(s) per core:              1
Core(s) per socket:              1
Socket(s):                       16
NUMA node(s):                    1
Vendor ID:                       GenuineIntel
CPU family:                      6
Model:                           63
Model name:                      Intel(R) Xeon(R) CPU E5-2667 v3 @ 3.20GHz
Stepping:                        2
CPU MHz:                         3192.308
BogoMIPS:                        6384.61
Hypervisor vendor:               VMware
Virtualization type:             full
L1d cache:                       512 KiB
L1i cache:                       512 KiB
L2 cache:                        4 MiB
L3 cache:                        320 MiB
NUMA node0 CPU(s):               0-15
Vulnerability Itlb multihit:     KVM: Vulnerable
Vulnerability L1tf:              Mitigation; PTE Inversion
Vulnerability Mds:               Vulnerable: Clear CPU buffers attempted, no microcode; SMT Host state unknown
Vulnerability Meltdown:          Mitigation; PTI
Vulnerability Spec store bypass: Vulnerable
Vulnerability Spectre v1:        Mitigation; usercopy/swapgs barriers and __user pointer sanitization
Vulnerability Spectre v2:        Mitigation; Full generic retpoline, STIBP disabled, RSB filling
Vulnerability Srbds:             Not affected
Vulnerability Tsx async abort:   Not affected
Flags:                           fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr
                                 sse sse2 ss syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon nopl xtopology tsc_rel                                 iable nonstop_tsc cpuid pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popc                                 nt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm cpuid_fault invpci                                 d_single pti fsgsbase tsc_adjust bmi1 avx2 smep bmi2 invpcid xsaveopt arat

Samson Olugbenga Idowu

unread,
Jun 7, 2023, 8:19:05 AM6/7/23
to Wazuh mailing list
Hello, the resources allocated looks good.

I advise that you repeat the procedure from start and take note of every step.
Perhaps, you can clear out the previous installation done.
Reply all
Reply to author
Forward
0 new messages