Corrupt active file after newgroup control message

[Russ Allbery]

Toon van der Pas <toon at hout.vanvergehaald.nl> writes:

> Recently a new problem developed on our news server.  To document the
> problem I use the last newgroup control message that caused the problem
> (lots of newgroup control messages get processed correctly).

> Today at 12:10 pm dutch time we received a newgroup control message:

> Nov 20 12:10:15 news controlchan[19458]: control_newgroup, finet.binaries.keskustelu.sarjakuvat news at finnet.fi news at finnet.fi @05000000517A00012BA40000000000000000@, 10.0.1.100, doit, 1

> After processing this message innd stopped:

> Nov 20 12:10:16 news innd: k:finet.binaries.keskustelu.sarjakuvat:y:news at finnet.fi
> Nov 20 12:10:16 news innfeed[19459]: ME source lost . Exiting
> Nov 20 12:10:16 news innfeed[19459]: bit global seconds 73547 offered 0 accepted 0 refused 0 rejected 0 missing 0 accsize 0 rejsize 0 spooled 0 unspooled 0
> Nov 20 12:10:16 news innfeed[19459]: ME global seconds 73550 offered 0 accepted 0 refused 0 rejected 0 missing 0 accsize 0 rejsize 0 spooled 0 unspooled 0
> Nov 20 12:10:16 news innfeed[19459]: ME finishing at Mon Nov 20 12:10:16 2006

> Analysis of the file /usr/local/news/db/active turned up that the
> group was added there, but that the record was prefixed by 2117 NULL-
> bytes! See below the last part of the hex dump of the active file:

Usually this is the kind of thing that happens if the active file is
edited with a regular editor behind the back of INN without throttling the
server first.  INN often writes out the active file assuming that it knows
offsets and file size (and may even be using mmap), so if something
changes the active file behind its back, it will be unaware of those
changes and won't adjust accordingly.

In this case, I would expect these symptoms if someone had deleted exactly
2117 characters from the active file without telling INN to reload it.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>

    Please send questions to the list rather than mailing me directly.
     <http://www.eyrie.org/~eagle/faqs/questions.html> explains why.