<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>----- Original message -----
<br>> Thanks for the quick reply.  See my comments below.
<br>>
<br>> > -----Original Message-----
<br>> > From: <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a> [mailto:syslog-ng-
<br>> > <a href="mailto:bounces@lists.balabit.hu">bounces@lists.balabit.hu</a>] On Behalf Of Balazs Scheidler
<br>> > Sent: Saturday, March 31, 2012 2:22 PM
<br>> > To: Syslog-ng users' and developers' mailing list
<br>> > Subject: Re: [syslog-ng] Ongoing 3.3.4 memory leaks
<br>> >
<br>> > On Fri, 2012-03-30 at 16:52 -0500, Marvin Nipper wrote:
<br>> > > Hi.
<br>> > >
<br>> > > Sorry, looking for some help.  Still trying to chase some memory
<br>> > leaks
<br>> > > that I see on Solaris 10.  I’ll crank up syslog-ng, and it’ll start
<br>> > > running at around 7 or 8MB, and interestingly, it will run that way
<br>> > > sometimes for several hours, and then (for reasons unknown), I’ll
<br>> > take
<br>> > > a look at it a bit later, and suddenly it will have jumped to 26MB
<br>> > (or
<br>> > > later on, maybe 75MB).  I’ve already applied the (older) logwriter.c
<br>> > > fix and the (new) Gergely driver.h/afsocket.c fix, in an attempt to
<br>> > > resolve known issues.  Certainly the logwriter fix corrected a
<br>> > > super-nasty, continuous leak problem, but this other leak problem
<br>> > > still lingers.
<br>> >
<br>> > I'm not sure which fixes you've applied. Can you post a better
<br>> > reference?
<br>> [Marvin Nipper]
<br>> They are the logwriter fix that you mentioned just below, and also the
<br>> afsocket patch that you were discussing this weekend in the "Memory leak
<br>> reintroduced in 3.3.3" thread.  However, based upon your comments (in
<br>> that thread), I plan to "unwind" that set of changes, as it seems like
<br>> those may not have been legit.
<br>>
<br>>
<br>
<br>I've processed those after answering your email.
<br>
<br>>
<br>> >
<br>> > I've applied only one patch after v3.3.4 got released which fixes a
<br>> > memory leak, this one:
<br>> >
<br>> > logwriter: fixed a memory leak for messages that couldn't be
<br>> > flushed at once
<br>> >
<br>> > Sometimes a message is dequeued, and then can't be posted to the
<br>> > destination
<br>> > (probably because of an EAGAIN or something like that). In this
<br>> > case
<br>> > it is readded back to the queue. In this case a reference was lost,
<br>> > causing
<br>> > a memory leak, but not for all messages, but only for the affected
<br>> > ones.
<br>> >
<br>> > Reported-By: Evan Rempel <<a href="mailto:erempel@uvic.ca">erempel@uvic.ca</a>>
<br>> > Signed-off-by: Balazs Scheidler <<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>>
<br>> >
<br>> > I can't remember anything else, hopefully I haven't missed patches by
<br>> > Gergely.
<br>> > >
<br>> > > MY PROBLEM is that I’m wanting to use the debug symbols in syslog-ng,
<br>> > > so that I can have the Solaris tools specifically show the exact
<br>> > > location where these leaks are happening, BUT, whereas a non-
<br>> > debugging
<br>> > > version of syslog-ng executes properly, when I configure syslog-ng
<br>> > > with –enable-debug, the resulting executable will no longer start.
<br>> > It
<br>> > > immediately exits, coughing up what amounts to a syntax error (even
<br>> > > though I’m using the exact same command-line invocation that I use on
<br>> > > the non-debugged executable):
<br>> > >
<br>> > >
<br>> > > #/etc/init.d/syslog-ng start
<br>> > > syslog-ng service starting.
<br>> > > mkfifo: File exists
<br>> > > mkfifo: File exists
<br>> > > Usage: /usr/local/sbin/syslog-ng { start | stop }
<br>> > > #
<br>> > >
<br>> > > Something about enabling debugging is impacting the operational
<br>> > > behavior of the resulting binary.
<br>> >
<br>> > Hmm.  That output is strange, you said you were running Solaris, but
<br>> > Solaris uses SMF for service management. Yet, you executed an sysv init
<br>> > script, which then complained that /usr/local/sbin/syslog-ng has
<br>> > different options, even though /usr/local/sbin/syslog-ng is probably
<br>> > your syslog-ng executable (or at least that's the default path).
<br>> >
<br>> > Can you perhaps start syslog-ng by hand?
<br>> >
<br>> > /usr/local/sbin/syslog-ng -F
<br>> >
<br>> > should do it.
<br>> [Marvin Nipper]
<br>> Actually, I had already done that, but here's that output, just to show
<br>> you: # /usr/local/sbin/syslog-ng \
<br>> > -F -f /etc/syslog-ng/syslog-ng.conf \
<br>> > -p /var/run/syslog-ng.pid \
<br>> > --persist-file=/usr/local/syslog-ng/syslog-ng.persist
<br>> Usage: /usr/local/sbin/syslog-ng { start | stop }
<br>>
<br>
<br>this isn't syslog-ng that produces this output. maybe the installation overwrote it? is that file a shell script?
<br>
<br>>
<br>>
<br>>
<br>>  Debug symbols shouldn't affect how things run.
<br>> > --enable-debug only adds a couple of options to CFLAGS, and only if the
<br>> > compiler is gcc.
<br>> >
<br>> > if test "x$ac_compiler_gnu" = "xyes"; then
<br>> > CFLAGS="${CFLAGS} -Wall"
<br>> > if test "x$enable_debug" = "xyes"; then
<br>> > CFLAGS="${ac_cv_env_CFLAGS_value} -Wall -g"
<br>> > fi
<br>> >
<br>> > if test "x$enable_gprof" = "xyes"; then
<br>> > CFLAGS="${CFLAGS} -pg"
<br>> > fi
<br>> > if test "x$enable_gcov" = "xyes"; then
<br>> > CFLAGS="${CFLAGS} -fprofile-arcs -ftest-coverage"
<br>> > fi
<br>> > fi
<br>> > CFLAGS="${CFLAGS} -pthread"
<br>> >
<br>> > If nothing else, try passing -g in CFLAGS before running configure,
<br>> > without
<br>> > passing --enable-debug.
<br>> [Marvin Nipper]
<br>> I actually didn't even know that the --enable-debug option existed in
<br>> the syslog-ng config, and so I started this effort by doing a
<br>> compilation with -g in CFLAGS, and that's when I first encountered the
<br>> syntax issue (that results in the "Usage" error).  When that goofy
<br>> result occurred, I figured that I'd done something wrong, and then
<br>> stumbled into the debug capability "built into" your configure
<br>> scripting, so I tried that next, which ends up with the same result.
<br>>
<br>> So, I don't know if this is yet another "goofy Solaris problem", but
<br>> some aspect of enabling the debug symbols, seems to frak up some aspect
<br>> of processing the command line at startup.
<br>>
<br>> If you have any other ideas or thoughts, I'll certainly take them.  I
<br>> appreciate your time and input.
<br>>
<br>>
<br>>
<br>> >
<br>> > >
<br>> > > Anyway, I can use (for Solaris) libumem and mdb to narrow this down
<br>> > to
<br>> > > a particular module, but without the debug symbols, I can’t really
<br>> > get
<br>> > > to a specific chunk of code, so it would obviously help to get that
<br>> > > working.  If anyone has any ideas, I certainly would appreciate the
<br>> > > input.
<br>> > >
<br>> >
<br>> > It'd really be appreciated if you could point out where the leak is
<br>> > happening. It might be use-case specific or some failure handler or
<br>> > whatever. Let's hope that starting syslog-ng from the command line
<br>> > works.
<br>> >
<br>> > --
<br>> > Bazsi
<br>> >
<br>> >
<br>> > _______________________________________________________________________
<br>> > _______
<br>> > Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> > Documentation:
<br>> > <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
<br>> > FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>>
<br>>
<br>>
<br>> This e-mail may contain confidential and/or privileged information. If
<br>> you are not the intended recipient (or have received this e-mail in
<br>> error) please  notify the sender immediately and destroy this e-mail.
<br>> Any unauthorized  copying, disclosure or distribution of the material in
<br>> this e-mail is strictly  forbidden.
<br>>
<br>> ______________________________________________________________________________
<br>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> Documentation:
<br>> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ:
<br>> <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>>
<br><br></p>
</body>
</html>