splunk-connect-for-syslog icon indicating copy to clipboard operation
splunk-connect-for-syslog copied to clipboard

Published 20 hours ago • verified publisher icon splunk

Multiple "Failed to JIT compile regular expression, you might want to use flags(disable-jit)"

Open kobz360 opened this issue 1 year ago • 1 comments

What is the sc4s version ? 3.4.5

Describe the bug Hi Team, I have recently upgraded our SC4S BYOE environment from 2.49.3 to 3.4.5 (along with upgrading the underlying Syslog-NG package to match what SC4S wants), however, since doing so, I have observed a range of the JIT compilation errors on startup in Journalctl. Ultimately, it does not stop the SC4S service from running, however, I suspect it may potentially be impacting the parsing or performance of the impacted parsers.

There's limited information on this online, but it looks like it may be to due with the move to PCRE2.

I will post some attachments below: Screenshot 2023-10-17 at 11 04 07 am

kobz360 avatar Oct 17 '23 00:10 kobz360

We will try to replicate it.

rjha-splunk avatar Oct 19 '23 07:10 rjha-splunk