https://bugzilla.balabit.com/show_bug.cgi?id=39 Summary: Memory exhaustion when using UDP destination to send to a remote server. Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: gillespiem@pa.net Type of the Report: --- Estimated Hours: 0.0 I have noticed that if syslog-ng receives an ICMP Type 3 / Code 3 message from a syslog-ng server configured as a remote destination (using UDP as the transport), the syslog-ng process starts consuming more and more memory, finally exhausting all resources. I've found this issue can be consistently replicated. Centos 5.2 (Final) syslog-ng 2.1.3 syslog-ng.conf (snippet from sending server) destination d_syslog_rtr0 {udp("syslog-server.blah.com" port(514));}; Config on receiving server doesn't matter, you can send the packets to a blackhole when replicating the issue. Steps to replicate: Using tcpdump, determine the port the sending server is using to send messages. Then, using sing (or any packetcrafting tool), do the following (or similar): sing -du -S <receiving syslog server IP> -x port-unreach -prot udp -psrc <Sending server source port (determined above)> --pdst 514 <Sending syslog server> When viewing processes using "top", it's apparent that memory usage of the syslog-ng process starts increasing every ~2 seconds, until the server has exhausted all memory. (I can replicate this on 3 separate servers) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.