On Mon, 2010-06-28 at 12:30 +1200, andy kitchingman wrote:

Hi

Due to my company firewall, I do not have access to the git public repository, so I will post this here.

I believe there is a memory leak when duplicate messages are suppressed and messages cannot be consumed:

logwriter.c: log_writer_last_msg_flush(LogWriter *self)

-------------------------------------------

log_queue_push_tail(self->queue, m, &path_options) can return FALSE (message cannot be consumed), in which case the local LogMessage m is leaked.

The fix should be something like

if (!log_queue_push_tail(self->queue, m, &path_options))

{

log_msg_unref(m);

}

Thanks for the report, but this patch breaks flow control. Seemingly better fix for the problem is: diff --git a/src/logwriter.c b/src/logwriter.c index dcc9584..86d1e07 100644 --- a/src/logwriter.c +++ b/src/logwriter.c @@ -356,7 +356,15 @@ log_writer_last_msg_flush(LogWriter *self) path_options.flow_control = FALSE; - log_queue_push_tail(self->queue, m, &path_options); + if (!log_queue_push_tail(self->queue, m, &path_options)) + { + stats_counter_inc(self->dropped_messages); + msg_debug("Destination queue full, dropping suppressed message", + evt_tag_int("queue_len", log_queue_get_length(self->queue)), + evt_tag_int("mem_fifo_size", self->options->mem_fifo_size), + NULL); + log_msg_drop(m, &path_options); + } log_writer_last_msg_release(self); } I've also commited this to syslog-ng OSE 3.0 tree, it'll be forward ported over time to newer versions as well. Here's the git commit entry: commit 9c2c2be8b95add3789a91cec25ea92a3bd6ceedb Author: Balazs Scheidler <bazsi@balabit.hu> Date: Wed Jun 30 17:41:06 2010 +0200 logwriter: fix memory leak if the suppressed message doesn't fit into the queue In case a suppressed message couldn't be inserted into the destination FIFO, it was leaked. This patch correctly disposes of the message in this case. Reported-By: Andy Kitchingman -- Bazsi