Here's the NEWS entry: News for the 1.4.8 release (11/03/2000) Fixed memory leak in destination files (occured if you had several macro-expanded files) Added some new expansion macros: HOUR, MIN and SEC. Some new global options: time_reap() the number of seconds when an idle destination file is closed use_time_recvd()if you want your date expansion macros to use the received time, instead of the time specified in the log message. Updated documentation to include the changes above. Added contrib subdirectory to include init scripts and config files for various platforms. Scott, this should fix your memory problems. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt
Balazs Scheidler on Mon 6/11 11:13 +0100:
Here's the NEWS entry:
News for the 1.4.8 release (11/03/2000)
Fixed memory leak in destination files (occured if you had several macro-expanded files)
Yes, we definitely have a lot of those, from this entry: file("/var/log/syslog/$HOST/$PROGRAM/$YEAR.$MONTH.$DAY" ...) Which so far today has resulted in [~] $ find /var/log/syslog/ -type f -name `date +%Y.%m.%d` | wc -l 102 There's more expansions on a bad day when lots of stuff breaks ;)
Scott, this should fix your memory problems.
I just put it into production; I'll post back in few days (which is normally plenty of time to see the leak). Thanks again for all your help. I will remove my several-gig debug logs now ;)
Scott McDermott on Mon 6/11 12:01 -0500:
Here's the NEWS entry:
News for the 1.4.8 release (11/03/2000)
Fixed memory leak in destination files (occured if you had several macro-expanded files)
[...]
Scott, this should fix your memory problems.
I just put it into production; I'll post back in few days (which is normally plenty of time to see the leak).
Looks like you killed it. VM size of syslog-ng process has only grown from 1500k to 1564k since then and it's only used a few minutes of CPU. Before the fix, that would have been around 40 megs and several hours of CPU. It is possible that it still has a tiny slow leak (of 64k) but I would imagine that is normal drift of buffer sizes with different messages, etc. I'll let you know if it leaks even a little after a few weeks, but my guess is that we've killed it. Thanks again for all your help.
participants (2)
-
Balazs Scheidler
-
Scott McDermott