Bug #2560
Updated by Victor Julien almost 6 years ago
Setting preserve-order to false could be a workaround. Bug reported to Ubuntu https://bugs.launchpad.net/ubuntu/+source/jansson/+bug/1785077 (private issue for now) Suricata would crash when writing out an EVE record. It would get a SIGABRT with a line like: <pre> suricata: dump.c:337: do_dump: Assertion `value' failed. </pre> A backtrace would look like: e.g. <pre> #0 0x00007ffff62f8c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff62fc028 in __GI_abort () at abort.c:89 #2 0x00007ffff62f1bf6 in __assert_fail_base (fmt=0x7ffff6446058 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7ffff6f288d2 "value", file=file@entry=0x7ffff6f282cb "dump.c", line=line@entry=337, function=function@entry=0x7ffff6f28300 <__PRETTY_FUNCTION__.4233> "do_dump") at assert.c:92 #3 0x00007ffff62f1ca2 in __GI___assert_fail (assertion=assertion@entry=0x7ffff6f288d2 "value", file=file@entry=0x7ffff6f282cb "dump.c", line=line@entry=337, function=function@entry=0x7ffff6f28300 <__PRETTY_FUNCTION__.4233> "do_dump") at assert.c:101 #4 0x00007ffff6f22713 in do_dump (json=0x7fffbc0fb5d0, flags=1376, depth=0, dump=<optimized out>, data=0x7fffcdffa1c0) at dump.c:337 #5 0x00000000008704c3 in OutputJSONBuffer (js=0x7fffbc0fb5d0, file_ctx=0x1ca4300, buffer=0x7fffbc0cf488) at output-json.c:660 #6 0x000000000083afec in AlertJson (tv=0x1d063b0, aft=0x7fffbc0cf480, p=0x7ffff0267190) at output-json-alert.c:621 </pre>