August 2006 - syslog-ng - lists.balabit.hu

Problem with hostnames (keep_hostname(no);)
by Dukes Clayton 17 Aug '06

17 Aug '06

Hiya folks, Here's the situation: All devices log to syslog-ng Syslog-ng then forwards logs to individual NMS systems, like Ciscoworks, etc. We're setting up a demo of Loglogic and are forwarding from the NG server to Loglogic. I'm getting the messages on the Loglogic side, but the originating hostnames are coming in as the NG server, not the actual device names (so it only sees one source) I've tried setting keep_hostname(no); but this doesn't seem to correct the problem. Any suggestions? TIA! Clayton

1 0

How many log files does syslog0ng support
by Walt Rich 17 Aug '06

17 Aug '06

We are running version 1.6.11 on Solaris 10, and have Syslog-ng configured to log to 7 different files. It logs just fine to 6 of them but will not for some reason log to the 7th destination which we created this week. Please advise. Thanks!

2 1

syslog-ng on AIX
by Brian Loe 15 Aug '06

15 Aug '06

I've installed syslog-ng on the AIX box and I thought I had pretty much replaced AIX's syslogd with it. However, it appears as though I'm missing a lot. Cron is logging to mail, for instance, and with the original syslogd it also logged to it. Syslog-ng is running and logging network messages, its own messages and that's it. So, the question, what more do I need to look at?

2 3

re:kernel message logging
by Bruce M. Penrod 14 Aug '06

14 Aug '06

Balazs Scheidler wrote: >On Fri, 2006-08-11 at 16:11 -0700, Bruce Penrod wrote: >> As a workaround, I tried using klogd with syslog-ng. I did turn off the >> syslog-ng source for /proc/kmsg. Now I don't see kernel messages on my >> console, but I don't get any kernel message logging either. Again, >> should this work? I don't see that there should be any special source >> definition in syslog-ng.conf for this to work. > In addition to Sandor's response, I'd like to add that this combination > should work, however klogd uses its own syslog() implementation instead > of using the one in libc, and it does not support > unix-stream() /dev/log, only unix-dgram(). That's probably the reason > why it does not work.Thanks to both Sandor and Balazs for the answers to my kernel logging questions. I did not know about /proc/sys/kernel/printk, or that dmesg had the capability to set it, just like klogd. Learn something new all the time. I was using the unix-stream source for /dev/log. Might be good to explain the need to use the datagram source for klogd in the reference docs, although I don't see why anyone would want to use it now. I only tried it because of the console logging issue, which Sandor's suggestion has solved nicely. Thanks for the quick responses. Bruce

1 0

kernel message logging
by Bruce Penrod 14 Aug '06

14 Aug '06

I've been using syslogd/klogd for years on linux systems and it seems to work as described in its docs, no issues. Unfortunately, it isn't being maintained and I now need ipv6 capability. Hence, syslog-ng. I like the straightforward configuration file structure, and with its emerging ipv6 capability, it seems like the future of open source syslogging, but I'm running into a little trouble making a seamless transition from syslogd/klogd. Apart from the problem I described in my previous post concerning the hostname being dropped from messages forwarded over udp6 to a loghost, I'm also running into a little difficulty with kernel message handling. It seems that the internal syslog-ng kernel message logging lacks a feature present in klogd that allows inhibiting kernel messages from appearing on the console, unless they are above a command line settable priority level. With syslog-ng, I seem to be getting all of the kernel messages coming out on /dev/console. I'm in an embedded environment using the mtd flash kernel drivers, which generate a lot of info level messages while erasing and writing to raw flash devices. klogd allows me to inhibit these quite nicely. Am I correct that syslog-ng lacks this capability, or just that I don't know how to configure it? As a workaround, I tried using klogd with syslog-ng. I did turn off the syslog-ng source for /proc/kmsg. Now I don't see kernel messages on my console, but I don't get any kernel message logging either. Again, should this work? I don't see that there should be any special source definition in syslog-ng.conf for this to work. Thanks, Bruce.

3 2

Re: [syslog-ng] How can i log messages from slapd in one file and, not /var/log/messages
by Gustavo Mendes de Carvalho 12 Aug '06

12 Aug '06

Fernando, I have this filters and destinatiosn in my configuration file: #============== source s_all { unix-stream("/dev/log"); internal(); }; destination d_ldap { file("/var/log/ldap.log"); }; filter f_syslog { not facility(auth, authpriv) and not match(slapd); }; filter f_ldap { match("slapd"); }; log { source(s_all); filter(f_syslog); destination(d_syslog); }; log { source(s_all); filter(f_ldap); destination(d_ldap); }; #=============== Tha's all that you need to send all ldap messages to one single file. Gustavo > Date: Fri, 11 Aug 2006 12:15:03 -0300 > From: "Fernando Loureiro" <loureiro.fernando(a)gmail.com> > Subject: [syslog-ng] How can i log messages from slapd in one file and > not /var/log/messages > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <a000e3310608110815i15f6a5b5rdc513481f3bae7ee(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi All, > > I want to know how can i have all my log messages inside a file called > slapd.log. > > Actually it´s logging most messages in /var/log/messages and some in > /var/log/slapd/slapd.log. > > I created the following filter for this daemon: > filter f_openldap { > program(slapd); }; > > And, by the way, i don´t know whenever to use which of those filter > functions. Can somebody explain me? > > > Att, > -- Fernando >

1 0

How can i log messages from slapd in one file and not /var/log/messages
by Fernando Loureiro 11 Aug '06

11 Aug '06

Hi All, I want to know how can i have all my log messages inside a file called slapd.log. Actually it´s logging most messages in /var/log/messages and some in /var/log/slapd/slapd.log. I created the following filter for this daemon: filter f_openldap { program(slapd); }; And, by the way, i don´t know whenever to use which of those filter functions. Can somebody explain me? Att, -- Fernando

1 0

(no subject)
by krishna y 09 Aug '06

09 Aug '06

Please remove my id from this list. Thanks, Krishna Y

1 0

Re: syslog-ng Digest, Vol 16, Issue 5
by Fernando Loureiro 09 Aug '06

09 Aug '06

Here is my syslog-ng.conf On 8/7/06, syslog-ng-request(a)lists.balabit.hu <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: syslog-ng doesn't log messages (Sandor Geller) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 07 Aug 2006 10:36:41 +0200 > From: Sandor Geller <wildy(a)balabit.hu> > Subject: Re: [syslog-ng] syslog-ng doesn't log messages > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <44D6FB99.5070804(a)balabit.hu> > Content-Type: text/plain; charset=ISO-8859-2 > > Fernando Loureiro wrote: > > I think everything is ok with my conf but it isn't working with some > > applications such as openldap, apcupsd. > > > > Can somebody help me? Here is a part of my conf. > > > > > > []s > > -- Fernando > > > > > > ------------------------------ > > > > options { > > chain_hostnames(off); > > sync(0); > > use_dns(no); > > create_dirs(yes); > > }; > > > > source kernsrc { file("/proc/kmsg"); internal(); }; > > > > destination openldap { file("/var/log/openldap.log"); }; > > destination apcupsd { file("/var/log/apcupsd.log"); }; > > > > filter f_openldap { program(slapd); }; > > filter f_apcupsd { program(apcupsd); }; > > > > log { source(kernsrc); filter(f_openldap); > > destination(openldap); }; > > log { source(kernsrc); filter(f_apcupsd); > > destination(apcupsd); }; > > This is a very incomplete configuration. You missed /dev/log, userspace > processes don't log through /proc/mksg. > > -- > Sandor Geller > wildy(a)balabit.hu > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 16, Issue 5 > **************************************** >

2 1

RE: Re: syslog-ng 2.0rc1 memory usage (Balazs Scheidler)
by Martin, David M 09 Aug '06

09 Aug '06

applied the patch and resident size increased only marginally over a 10 minute period. much better. ran through valgrind another 10 minutes, here's the report. ==25356== Memcheck, a memory error detector for x86-linux. ==25356== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward et al. ==25356== Using valgrind-2.2.0, a program supervision framework for x86-linux. ==25356== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward et al. ==25356== ==25356== My PID = 25356, parent PID = 1284. Prog and args are: ==25356== ./syslog-ng ==25356== -dv ==25356== ==25356== Valgrind library directory: /usr/lib/valgrind ==25356== Command line ==25356== ./syslog-ng ==25356== -dv ==25356== Startup, with flags: ==25356== --tool=memcheck ==25356== -v ==25356== --leak-check=yes ==25356== --show-reachable=yes ==25356== --log-file=/tmp/debug.txt ==25356== Contents of /proc/version: ==25356== Linux version 2.6.9-34.ELsmp (bhcompile(a)hs20-bc1-7.build.redhat.com) (gcc version 3.4.5 20051201 (Red Hat 3.4.5-2)) #1 SMP Fri Feb 24 16:54:53 EST 2006 ==25356== Reading syms from /opt/sfw/syslogng/2.0rc1/sbin/syslog-ng (0x8048000) ==25356== Reading syms from /lib/ld-2.3.4.so (0x1B8E4000) ==25356== object doesn't have any debug info ==25356== Reading syms from /usr/lib/valgrind/stage2 (0xB0000000) ==25356== Reading syms from /lib/ld-2.3.4.so (0xB1000000) ==25356== object doesn't have any debug info ==25356== Reading syms from /usr/lib/valgrind/vgskin_memcheck.so (0xB7C3E000) ==25356== Reading syms from /lib/tls/libc-2.3.4.so (0xB7E67000) ==25356== object doesn't have any debug info ==25356== Reading syms from /lib/libdl-2.3.4.so (0xB7F92000) ==25356== object doesn't have any debug info ==25356== Reading suppressions file: /usr/lib/valgrind/default.supp ==25356== REDIRECT soname:libc.so.6(__GI___errno_location) to soname:libpthread.so.0(__errno_location) ==25356== REDIRECT soname:libc.so.6(__errno_location) to soname:libpthread.so.0(__errno_location) ==25356== REDIRECT soname:libc.so.6(__GI___h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==25356== REDIRECT soname:libc.so.6(__h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==25356== REDIRECT soname:libc.so.6(__GI___res_state) to soname:libpthread.so.0(__res_state) ==25356== REDIRECT soname:libc.so.6(__res_state) to soname:libpthread.so.0(__res_state) ==25356== REDIRECT soname:libc.so.6(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==25356== REDIRECT soname:libc.so.6(strnlen) to *vgpreload_memcheck.so*(strnlen) ==25356== REDIRECT soname:ld-linux.so.2(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==25356== REDIRECT soname:ld-linux.so.2(strchr) to *vgpreload_memcheck.so*(strchr) ==25356== ==25356== Reading syms from /usr/lib/valgrind/vg_inject.so (0x1B8FC000) ==25356== Reading syms from /usr/lib/valgrind/vgpreload_memcheck.so (0x1B901000) ==25356== TRANSLATE: 0x1B8F5F70 redirected to 0x1B904100 ==25356== Reading syms from /lib/libnsl-2.3.4.so (0xC09000) ==25356== object doesn't have any debug info ==25356== Reading syms from /lib/tls/librt-2.3.4.so (0xDD5000) ==25356== object doesn't have any debug info ==25356== Reading syms from /usr/lib/libglib-2.0.so.0.400.7 (0x101000) ==25356== object doesn't have a symbol table ==25356== object doesn't have any debug info ==25356== Reading syms from /opt/sfw/eventlog/0.2.5/lib/libevtlog.so.0.0.0 (0x1B910000) ==25356== Reading syms from /lib/tls/libc-2.3.4.so (0xA60000) ==25356== object doesn't have any debug info ==25356== Reading syms from /usr/lib/valgrind/libpthread.so (0x1B917000) ==25356== Reading syms from /lib/libdl-2.3.4.so (0xB8C000) ==25356== object doesn't have any debug info ==25356== TRANSLATE: 0xAC4030 redirected to 0x1B9048F8 ==25356== TRANSLATE: 0x1B8E47A0 redirected to 0x52BFF040 ==25356== TRANSLATE: 0xAC1F60 redirected to 0x1B904E24 ==25356== TRANSLATE: 0xAC3D50 redirected to 0x1B905274 ==25356== TRANSLATE: 0xA752D0 redirected to 0x1B91EB87 ==25356== TRANSLATE: 0xACA370 redirected to 0x1B9046F4 ==25356== Reading syms from /lib/libnss_files-2.3.4.so (0x1BA51000) ==25356== object doesn't have any debug info ==25356== TRANSLATE: 0xAC4670 redirected to 0x1B905326 ==25356== discard syms at 0x1BA51000-0x1BA5C000 in /lib/libnss_files-2.3.4.so due to munmap() ==25356== ==25356== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 22 from 2) --25356-- --25356-- supp: 2 _dl_relocate_object/dl_open_worker --25356-- supp: 20 dl_relocate_object/dl_main ==25356== malloc/free: in use at exit: 47118 bytes in 370 blocks. ==25356== malloc/free: 535 allocs, 165 frees, 58735 bytes allocated. ==25356== ==25356== searching for pointers to 370 not-freed blocks. ==25360== TRANSLATE: 0xAC9000 redirected to 0x1B9042D0 ==25360== Reading syms from /lib/libnss_dns-2.3.4.so (0x1BA49000) ==25360== object doesn't have any debug info ==25360== Reading syms from /lib/libresolv-2.3.4.so (0xC21000) ==25360== object doesn't have any debug info ==25356== checked 2396740 bytes. ==25356== ==25356== 8 bytes in 2 blocks are still reachable in loss record 1 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAF72C8: register_state (in /lib/tls/libc-2.3.4.so) ==25356== by 0xAF765A: create_cd_newstate (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB004C5: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== ==25356== ==25356== 8 bytes in 2 blocks are still reachable in loss record 2 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAF7439: create_cd_newstate (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB004C5: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== ==25356== ==25356== 12 bytes in 1 blocks are still reachable in loss record 3 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0x1B9123A7: evt_ctx_tag_hook_add (evtctx.c:126) ==25356== by 0x1B91248B: evt_ctx_init (evtctx.c:151) ==25356== by 0x804C228: msg_init (messages.c:124) ==25356== ==25356== ==25356== 16 bytes in 1 blocks are still reachable in loss record 4 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0xB8D364: _dlerror_run (in /lib/libdl-2.3.4.so) ==25356== by 0xB8CE3B: dlsym (in /lib/libdl-2.3.4.so) ==25356== by 0x1B91ECA6: __errno_location (vg_libpthread.c:2127) ==25356== ==25356== ==25356== 56 bytes in 14 blocks are still reachable in loss record 5 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAF9D1A: calc_eclosure_iter (in /lib/tls/libc-2.3.4.so) ==25356== by 0xAFF83F: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== ==25356== ==25356== 56 bytes in 2 blocks are still reachable in loss record 6 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFF59E: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 92 bytes in 1 blocks are still reachable in loss record 7 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0x1B912410: evt_ctx_init (evtctx.c:142) ==25356== by 0x804C228: msg_init (messages.c:124) ==25356== by 0x804BA3E: main (main.c:389) ==25356== ==25356== ==25356== 104 bytes in 2 blocks are still reachable in loss record 8 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0xAF73F8: create_cd_newstate (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB004C5: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== ==25356== ==25356== 112 bytes in 2 blocks are still reachable in loss record 9 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFEF10: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 168 bytes in 2 blocks are still reachable in loss record 10 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFF5F7: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 168 bytes in 2 blocks are still reachable in loss record 11 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFF5E3: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 168 bytes in 2 blocks are still reachable in loss record 12 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFF5CF: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 288 bytes in 2 blocks are still reachable in loss record 14 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0xAFEF3A: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 512 bytes in 2 blocks are still reachable in loss record 15 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xB0123F: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== by 0x8051DA5: filter_host_new (filter.c:345) ==25356== ==25356== ==25356== 3608 bytes in 120 blocks are still reachable in loss record 16 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0x1B905373: realloc (vg_replace_malloc.c:189) ==25356== by 0x12AC4B: g_realloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== by 0x13C55B: (within /usr/lib/libglib-2.0.so.0.400.7) ==25356== ==25356== ==25356== 4784 bytes in 118 blocks are still reachable in loss record 17 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== by 0x804CA1A: cfg_new (cfg.c:231) ==25356== by 0x804BA53: main (main.c:392) ==25356== ==25356== ==25356== 16438 bytes in 3 blocks are still reachable in loss record 18 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0x804E8EA: yyalloc (cfg-lex.c:1958) ==25356== by 0x804E55B: yyensure_buffer_stack (cfg-lex.c:1693) ==25356== by 0x804DFD0: yyrestart (cfg-lex.c:1467) ==25356== ==25356== ==25356== 20320 bytes in 91 blocks are still reachable in loss record 19 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0x12AB72: g_malloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== by 0x12B6D6: g_mem_chunk_new (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== by 0x130DD7: g_queue_new (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== ==25356== LEAK SUMMARY: ==25356== definitely lost: 0 bytes in 0 blocks. ==25356== possibly lost: 0 bytes in 0 blocks. ==25356== still reachable: 46918 bytes in 369 blocks. ==25356== suppressed: 200 bytes in 1 blocks. --25356-- TT/TC: 0 tc sectors discarded. --25356-- 6727 tt_fast misses. --25356-- translate: new 6283 (108562 -> 1439356; ratio 132:10) --25356-- discard 124 (1626 -> 21552; ratio 132:10). --25356-- chainings: 4327 chainings, 3 unchainings. --25356-- dispatch: 150000 jumps (bb entries); of them 33019 (22%) unchained. --25356-- 188/7945 major/minor sched events. --25356-- reg-alloc: 1248 t-req-spill, 266926+8325 orig+spill uis, --25356-- 32968 total-reg-rank --25356-- sanity: 99 cheap, 4 expensive checks. --25356-- ccalls: 27187 C calls, 55% saves+restores avoided (89446 bytes) --25356-- 36049 args, avg 0.87 setup instrs each (8718 bytes) --25356-- 0% clear the stack (81192 bytes) --25356-- 10763 retvals, 32% of reg-reg movs avoided (6762 bytes) ==25360== TRANSLATE: 0xB37F10 redirected to 0x1B91EE2A ==25360== TRANSLATE: 0xB3C050 redirected to 0x1B91ED13 ==25360== discard syms at 0x1BA51000-0x1BA5C000 in /lib/libnss_files-2.3.4.so due to munmap() ==25360== discard syms at 0x1BA49000-0x1BA4F000 in /lib/libnss_dns-2.3.4.so due to munmap() ==25360== discard syms at 0xC21000-0xC34000 in /lib/libresolv-2.3.4.so due to munmap() ==25360== ==25360== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 25 from 2) --25360-- --25360-- supp: 5 _dl_relocate_object/dl_open_worker --25360-- supp: 20 dl_relocate_object/dl_main ==25360== malloc/free: in use at exit: 38779 bytes in 173 blocks. ==25360== malloc/free: 12356936 allocs, 12356763 frees, 294589976 bytes allocated. ==25360== ==25360== searching for pointers to 173 not-freed blocks. ==25360== checked 2394928 bytes. ==25360== ==25360== 16 bytes in 1 blocks are still reachable in loss record 1 of 8 ==25360== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25360== by 0xB8D364: _dlerror_run (in /lib/libdl-2.3.4.so) ==25360== by 0xB8CE3B: dlsym (in /lib/libdl-2.3.4.so) ==25360== by 0x1B91ECA6: __errno_location (vg_libpthread.c:2127) ==25360== ==25360== ==25360== 108 bytes in 1 blocks are definitely lost in loss record 2 of 8 ==25360== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25360== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x80530FD: log_msg_new (logmsg.c:545) ==25360== by 0x804C0A7: msg_send_internal_message (messages.c:57) ==25360== ==25360== ==25360== 128 bytes in 1 blocks are still reachable in loss record 3 of 8 ==25360== at 0x1B9053EE: realloc (vg_replace_malloc.c:197) ==25360== by 0x12AC4B: g_realloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x13C55B: (within /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x13CACD: g_string_insert_len (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== ==25360== ==25360== 3272 bytes in 45 blocks are still reachable in loss record 5 of 8 ==25360== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25360== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x80530FD: log_msg_new (logmsg.c:545) ==25360== by 0x804C0A7: msg_send_internal_message (messages.c:57) ==25360== ==25360== ==25360== 3984 bytes in 84 blocks are still reachable in loss record 6 of 8 ==25360== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25360== by 0x1B905373: realloc (vg_replace_malloc.c:189) ==25360== by 0x12AC4B: g_realloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x13C55B: (within /usr/lib/libglib-2.0.so.0.400.7) ==25360== ==25360== ==25360== 14633 bytes in 37 blocks are still reachable in loss record 7 of 8 ==25360== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25360== by 0x12AB72: g_malloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x12B6D6: g_mem_chunk_new (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x130DD7: g_queue_new (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== ==25360== ==25360== 16438 bytes in 3 blocks are still reachable in loss record 8 of 8 ==25360== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25360== by 0x804E8EA: yyalloc (cfg-lex.c:1958) ==25360== by 0x804E55B: yyensure_buffer_stack (cfg-lex.c:1693) ==25360== by 0x804DFD0: yyrestart (cfg-lex.c:1467) ==25360== ==25360== LEAK SUMMARY: ==25360== definitely lost: 108 bytes in 1 blocks. ==25360== possibly lost: 0 bytes in 0 blocks. ==25360== still reachable: 38471 bytes in 171 blocks. ==25360== suppressed: 200 bytes in 1 blocks. --25360-- TT/TC: 0 tc sectors discarded. --25360-- 3473105 tt_fast misses. --25360-- translate: new 10152 (171521 -> 2315890; ratio 135:10) --25360-- discard 687 (11209 -> 143352; ratio 127:10). --25360-- chainings: 7759 chainings, 3 unchainings. --25360-- dispatch: 200000 jumps (bb entries); of them 337925145 (168962%) unchained. --25360-- 1207539/32139357 major/minor sched events. --25360-- reg-alloc: 1915 t-req-spill, 428681+13190 orig+spill uis, --25360-- 52732 total-reg-rank --25360-- sanity: 641240 cheap, 25650 expensive checks. --25360-- ccalls: 44737 C calls, 56% saves+restores avoided (149268 bytes) --25360-- 58904 args, avg 0.88 setup instrs each (13864 bytes) --25360-- 0% clear the stack (133704 bytes) --25360-- 17609 retvals, 33% of reg-reg movs avoided (11332 bytes) ------------------------------ Message: 8 Date: Tue, 08 Aug 2006 22:02:03 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Re: syslog-ng 2.0rc1 memory usage To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1155067324.11773.2.camel(a)bzorp.balabit> Content-Type: text/plain; charset="us-ascii" On Mon, 2006-08-07 at 19:11 -0500, Martin, David M wrote: > I ran valgrind with these options for 10 minutes: > > valgrind --tool=memcheck -v --leak-check=yes --show-reachable=yes > --log-file=/tmp/debug.txt ./syslog-ng -dv Attached my latest set of leak fixes, please check if it fixes your problem. I've also committed it, so it should be available in tomorrow's snapshot. Thanks again for helping me to debug this problem. -- Bazsi

2 1