[systemd-bugs] [Bug 55239] journalctl and parsing corrupted journals

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=55239

--- Comment #2 from Nicholas Miell <nmiell at gmail.com> ---
It should recognize portions of the file are corrupted and start searching for
magic numbers indicating a record from that point. When it finds a candidate
magic number, it should check the record's checksum at the known offset from
the magic number to verify it actually found a record and not just a spurious
magic number. Once it finds an intact record again, it should continue parsing
journal records as normal (until the next corrupt region, if any).

ObjectHeader has 6 reserved uint8_t's to use for the magic number and checksum,
so this would be a compatible change.

Then you could make a tool (or just modify journalctl) that takes a damaged
journal as input and converts all the damaged regions into artificially
generated log entries saying something like MESSAGE="Damaged Region #1" with an
attached DATA=the original corrupted binary data.


Essentially, journalctl's current behavior of pretending the journal file ends
at the first damaged region is unacceptable.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/systemd-bugs/attachments/20141018/17dab3f3/attachment-0001.html>