On Thu, 2006-07-20 at 19:47 -0500, Martin, David M wrote:
Anyone running 2.0rc1 on Solaris 9 (sparc)? If so, what memory requirements are you seeing for the syslog-ng process?
My install handles ~ 700 messages/sec (all UDP) and over the course of a day syslog-ng will gradually consume nearly all available free memory (I've seen it up to 1GB).
(syslog-ng is bounced by logrotate daily, so the process repeats itself) I was able to substantially decrease the rate of consumption by adding the 'flush_lines" global (syslog-ng process now at 91MB and growing ... slowly).
I installed 2.0rc1 on one server, kept another at 1.6.8 (roughly 500 messages/sec load). The syslog-ng process there is stable at 3 MB.
I could not reproduce the leak so far locally, although I fixed some one-off allocation leaks but that should only affect reloads and not simply running the process. I suspect this is strict production environment, but I ask anyway, can you run something like valgrind on the syslog-ng process? Another idea is to use the built-in leak finder in syslog-ng, it is not as intrusive but might still help. If neither of these is possible, I could still use a core file dumped when syslog-ng is large in size. (I'd need debugging symbols on the syslog-ng executable as well) There must be some kind of usage pattern that I miss here, but without that I cannot fix the problem. -- Bazsi