GeoIP processor warnings

Graylog Central (peer support)
1

hi,

I updated the Maxmind database (City Lite). It seems, that after that the GeoIP plugin throws exceptions when encountering internal (10.x.x.x) addresses:

2017-03-14T10:32:13.176+00:00 WARN  [ProcessBuffer] Unable to process event MessageEvent{raw=null, message=null, messages=null}, sequence 144912204
java.lang.InternalError: a fault occurred in a recent unsafe memory access operation in compiled Java code
        at com.maxmind.db.Decoder$Type.get(Decoder.java:52) ~[?:?]
        at com.maxmind.db.Decoder.decode(Decoder.java:128) ~[?:?]
        at com.maxmind.db.Decoder.decode(Decoder.java:87) ~[?:?]
        at com.maxmind.db.Reader.resolveDataPointer(Reader.java:252) ~[?:?]
        at com.maxmind.db.Reader.get(Reader.java:150) ~[?:?]
        at com.maxmind.geoip2.DatabaseReader.get(DatabaseReader.java:151) ~[?:?]
        at com.maxmind.geoip2.DatabaseReader.city(DatabaseReader.java:202) ~[?:?]
        at org.graylog.plugins.map.geoip.GeoIpResolverEngine.extractGeoLocationInformation(GeoIpResolverEngine.java:106) ~[?:?]
        at org.graylog.plugins.map.geoip.GeoIpResolverEngine.filter(GeoIpResolverEngine.java:79) ~[?:?]
        at org.graylog.plugins.map.geoip.processor.GeoIpProcessor.process(GeoIpProcessor.java:79) ~[?:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.handleMessage(ProcessBufferProcessor.java:119) ~[graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.dispatchMessage(ProcessBufferProcessor.java:105) ~[graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:82) ~[graylog.jar:?]
        at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:45) ~[graylog.jar:?]
        at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
        at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121]
2

Does the exception occur every time a private IP address (such as 127.0.0.1, 192.168.0.0/24, or 10.0.0.0/8) is being processed?

It looks like an error in the GeoIP library Graylog is using, so I’m not sure there’s much we can do about it.

3

I have not really tested properly, I cannot say. At the moment there are more pressing issues, so I doubt I’ll look at it very soon.