<div dir="ltr"><div>Hi,<br><br></div>we do release those buffers, but the libc malloc() may not. <br><br>It could make sense to LD_PRELOAD the jemalloc allocator, that is better at returning pages to the system.<br><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote">On Thu, Jan 11, 2018 at 11:54 PM, Patrick Hemmer <span dir="ltr"><<a href="mailto:syslogng@stormcloud9.net" target="_blank">syslogng@stormcloud9.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
We're seeing an issue on our systems where syslog-ng is consuming an
excessive amount of memory, approximately 380mb (RSS) right now on
one of our hosts.<br>
I'm not sure what's causing this as our config is pretty minimal,
and there are no destinations unavailable which would cause it to
buffer. We do have `log-msg-size(65536)` and `log-fifo-size(10000)`
which might have caused it to buffer a large amount some time in the
past, but would it not release these buffers?<br>
<br>
Version 3.13.2 on CentOS/7 (RPM from
<a class="m_-1350886579924916691moz-txt-link-freetext" href="https://copr.fedorainfracloud.org/coprs/czanik/syslog-ng313/" target="_blank">https://copr.fedorainfracloud.<wbr>org/coprs/czanik/syslog-ng313/</a><wbr>)<br>
<br>
Config:<br>
<font color="#990000"><tt>@version:3.13</tt><tt><br>
</tt><tt>@include "scl.conf"</tt><tt><br>
</tt><tt><br>
</tt><tt># This configuration is meant to utilize systemd journald</tt><tt><br>
</tt><tt>options {</tt><tt><br>
</tt><tt> flush_lines(0);</tt><tt><br>
</tt><tt> time_reopen(10);</tt><tt><br>
</tt><tt> log-msg-size(65536);</tt><tt><br>
</tt><tt> log_fifo_size(10000);</tt><tt><br>
</tt><tt> chain_hostnames(off);</tt><tt><br>
</tt><tt> use_dns(no);</tt><tt><br>
</tt><tt> use_fqdn(yes);</tt><tt><br>
</tt><tt> keep_hostname(yes);</tt><tt><br>
</tt><tt> create_dirs(no);</tt><tt><br>
</tt><tt> stats_freq(3600);</tt><tt><br>
</tt><tt>};</tt><tt><br>
</tt><tt><br>
</tt><tt>source s_system { system(); };</tt><tt><br>
</tt><tt>source s_internal { internal(); };</tt><tt><br>
</tt><tt><br>
</tt><tt>destination d_journald {</tt><tt><br>
</tt><tt> unix-dgram("/dev/log" flush-lines(1)
template("${MSG}\n"));</tt><tt><br>
</tt><tt>};</tt><tt><br>
</tt><tt><br>
</tt><tt>log { source(s_internal); destination(d_journald); };</tt><tt><br>
</tt><tt><br>
</tt><tt>destination d_loghost {</tt><tt><br>
</tt><tt> syslog("<a href="http://syslog.ecom.chewy.com" target="_blank">syslog.ecom.chewy.com</a>"</tt><tt><br>
</tt><tt> frac-digits(3)</tt><tt><br>
</tt><tt> log-fifo-size(10000)</tt><tt><br>
</tt><tt> );</tt><tt><br>
</tt><tt>};</tt><tt><br>
</tt><tt><br>
</tt><tt>log { source(s_system); destination(d_loghost); };</tt></font><br>
<br>
Stats:<br>
<br>
<font color="#990000"><tt># syslog-ng-ctl stats</tt><tt><br>
</tt><tt>SourceName;SourceId;<wbr>SourceInstance;State;Type;<wbr>Number</tt><tt><br>
</tt><tt>dst.syslog;d_loghost#0;tcp,<wbr>syslog.ecom.chewy.com:601;a;<wbr>dropped;163025</tt><tt><br>
</tt><tt>dst.syslog;d_loghost#0;tcp,<wbr>syslog.ecom.chewy.com:601;a;<wbr>processed;489030242</tt><tt><br>
</tt><tt>dst.syslog;d_loghost#0;tcp,<wbr>syslog.ecom.chewy.com:601;a;<wbr>queued;1</tt><tt><br>
</tt><tt>dst.syslog;d_loghost#0;tcp,<wbr>syslog.ecom.chewy.com:601;a;<wbr>written;488867216</tt><tt><br>
</tt><tt>destination;d_journald;;a;<wbr>processed;1997</tt><tt><br>
</tt><tt>src.internal;s_internal#0;;a;<wbr>processed;1997</tt><tt><br>
</tt><tt>src.internal;s_internal#0;;a;<wbr>stamp;1515709115</tt><tt><br>
</tt><tt>center;;received;a;processed;<wbr>1997</tt><tt><br>
</tt><tt>destination;d_loghost;;a;<wbr>processed;489030242</tt><tt><br>
</tt><tt>source;s_internal;;a;<wbr>processed;1997</tt><tt><br>
</tt><tt>center;;queued;a;processed;<wbr>489032239</tt><tt><br>
</tt><tt>global;scratch_buffers_count;;<wbr>a;queued;25769803782</tt><tt><br>
</tt><tt>dst.unix-dgram;d_journald#0;<wbr>unix-dgram,localhost.afunix:/<wbr>dev/log;a;dropped;0</tt><tt><br>
</tt><tt>dst.unix-dgram;d_journald#0;<wbr>unix-dgram,localhost.afunix:/<wbr>dev/log;a;processed;845</tt><tt><br>
</tt><tt>dst.unix-dgram;d_journald#0;<wbr>unix-dgram,localhost.afunix:/<wbr>dev/log;a;queued;0</tt><tt><br>
</tt><tt>dst.unix-dgram;d_journald#0;<wbr>unix-dgram,localhost.afunix:/<wbr>dev/log;a;written;845</tt><tt><br>
</tt><tt>global;payload_reallocs;;a;<wbr>processed;2932894697</tt><tt><br>
</tt><tt>src.journald;;journal;a;<wbr>processed;489030242</tt><tt><br>
</tt><tt>src.journald;;journal;a;stamp;<wbr>1515710081</tt><tt><br>
</tt><tt>global;sdata_updates;;a;<wbr>processed;0</tt><tt><br>
</tt><tt>global;scratch_buffers_bytes;;<wbr>a;queued;0</tt><tt><br>
</tt><tt>global;msg_clones;;a;<wbr>processed;135</tt><tt><br>
</tt><tt>global;internal_queue_length;;<wbr>a;processed;0</tt></font><br>
<br>
Thanks<span class="HOEnZb"><font color="#888888"><br>
<br>
-Patrick<br>
<br>
<br>
</font></span></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>