On Tue, 2005-03-29 at 13:08 -0500, henry@shoelacecity.com wrote:
I've sucessfully beaten down the memory leak issues I've been experiencing thanks to Balazs suggested patches.
I am now experiencing a different sort of "leak". I worked back from the log files to identify the problem, but not the cause.
I restart syslog-ng weekly. Towards the end of each week, I notice log messages:
syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files)
A quick "lsof -c syslog-ng" revealed a few hundred open files. I restarted syslog-ng and checked for open files - the number was about 25. In the past hour of monitoring, that number has jumped to over 70. The "files" that appear to be increasing are these (from the output of lsof) :
syslog-ng 17081 root 61u raw 51703353 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 62u raw 51711769 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 63u raw 51721047 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 64u raw 51727149 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 65u raw 51738764 00000000:00FF->00000000:0000 st=07
My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled).
CPU utilization on the machine is less than 5%, and there's plenty of free memory.
Hmmm it is strange, you most certainly have an fd leak, even though the libnet context (ie. the raw socket) is initialized at destination initialization time and destroyed at deinitialization time, seemingly properly. This is only done on initialization and configuration file reload. Are you HUP-ing syslog-ng very often? I can't see how so many raw sockets accumulated, assuming that one fd is leaked for each HUP. -- Bazsi