On Friday 30 of March 2012, Gergely Nagy wrote:
Jakub Jankowski <shasta@toxcorp.com> writes:
I'm pretty sure this particular memory leak was fixed in 3.3.2, but then got reintroduced in this commit: http://git.balabit.hu/?p=bazsi/syslog-ng-3.3.git;a=commitdiff;h=c7070e2a6 f1c3a312260bcecf49d62028fef27ce which was done to fix tcp() destination related crash after 3.3.2 was released.
So, Bazsi, yes - it does reintroduce the leak :) (in reply to your comment in https://lists.balabit.hu/pipermail/syslog-ng/2011-November/017697.html )
I think I found the solution: the reason for the crash in afsocket, which Bazsi fixed with killing the log_queue_unref in lib/driver.h was that it was missing a log_queue_ref. We didn't unref more than we should, we reffed less!
While I don't entirely understand the call chain, comparing how affile and afsocket did their queue magic, I prepared a patch that does not crash afsocket on reload, and stops the leak aswell. It also looks sane-ish to me, so I'm reasonably sure it's fine.
The patch is attached, I tested it as much as I could: no crash, no leak, no empty files. If you could test it too, it would be most appreciated!
Thanks! With this patch I can no longer trigger this memory leak, indeed. I've forwarded it to my ex-coworkers who suffer from this on production servers (I'm not there anymore), so I hope to hear from them if it makes the leak go away there as well. I also hope others will test it too (especially Patrick H., who reported the tcp() crash). Ack from me on the memleak fix, though. As for the missing files - don't bother. It was a PEBKAC, and a completely unrelated issue. I needed to setup a testbed from scratch for this, and forgot to raise maximum fd limit before testing. So now fingers crossed for this patch to make it's way into 3.3 tree :) Thanks again, Gergely! Regards, -- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D