syslog-ng.ctl socket fd leak in 3.3.3
Hi, can anyone confirm my observations? $ lsof -n -p $(cat /var/run/syslog-ng.pid) | grep -c /var/lib/syslog-ng/syslog-ng.ctl 129 $ syslog-ng-ctl stats >/dev/null; echo $? 0 $ lsof -n -p $(cat /var/run/syslog-ng.pid) | grep -c /var/lib/syslog-ng/syslog-ng.ctl 130 $ I'm running a cronjob that dumps stats every minute, so the number of open fds is growing linearly, soon reaching configured open files limits. I'm using self-compiled 3.3.3: # syslog-ng -V syslog-ng 3.3.3 Installer-Version: 3.3.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.3#master#d199a1980be6b23fe24189e86a882812288e292c Compile-Date: Nov 18 2011 00:16:55 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat,afsql Available-Modules: afprog,syslogformat,convertfuncs,afuser,afsocket,afsocket-tls,csvparser,confgen,afsql,afmongodb,dummy,dbparser,affile,basicfuncs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: off Am I the only one seeing this? Regards, -- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D
Hi Jakub, confirmed. The other syslog-ng-ctl commands (verbose, debug, trace) also leave behind an open file descriptor. Peter Am 11.01.2012 12:52, schrieb Jakub Jankowski:
Hi,
can anyone confirm my observations?
$ lsof -n -p $(cat /var/run/syslog-ng.pid) | grep -c /var/lib/syslog-ng/syslog-ng.ctl 129 $ syslog-ng-ctl stats >/dev/null; echo $? 0 $ lsof -n -p $(cat /var/run/syslog-ng.pid) | grep -c /var/lib/syslog-ng/syslog-ng.ctl 130 $
Hi, the following patch fixes the problem for me. Not sure if this is the right place for the close(), though. Peter --- ../syslog-ng-3.3.3.orig/lib/control.c 2011-04-30 23:04:19.000000000 +0200 +++ lib/control.c 2012-01-11 13:41:56.000000000 +0100 @@ -244,8 +244,8 @@ return; destroy_connection: control_connection_stop_watches(self); + close(self->control_io.fd); control_connection_free(self); - } static void Am 11.01.2012 13:18, schrieb Peter Eisenlohr:
Hi Jakub,
confirmed. The other syslog-ng-ctl commands (verbose, debug, trace) also leave behind an open file descriptor.
Peter
Am 11.01.2012 12:52, schrieb Jakub Jankowski:
Hi,
can anyone confirm my observations?
$ lsof -n -p $(cat /var/run/syslog-ng.pid) | grep -c /var/lib/syslog-ng/syslog-ng.ctl 129 $ syslog-ng-ctl stats >/dev/null; echo $? 0 $ lsof -n -p $(cat /var/run/syslog-ng.pid) | grep -c /var/lib/syslog-ng/syslog-ng.ctl 130 $
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
On Wed, 2012-01-11 at 13:45 +0100, Peter Eisenlohr wrote:
Hi,
the following patch fixes the problem for me. Not sure if this is the right place for the close(), though.
Peter
--- ../syslog-ng-3.3.3.orig/lib/control.c 2011-04-30 23:04:19.000000000 +0200 +++ lib/control.c 2012-01-11 13:41:56.000000000 +0100 @@ -244,8 +244,8 @@ return; destroy_connection: control_connection_stop_watches(self); + close(self->control_io.fd); control_connection_free(self); - }
static void
Good catch. This close() probably went MIA when converting the code to ivykis. The patch below moves the close() call to the destructor function. Can you try if it works the same for you? Thanks. commit 3dc36259904aa1b206ee52e6ac2cd1266957cef0 Author: Balazs Scheidler <bazsi@balabit.hu> Date: Mon Jan 16 22:49:01 2012 +0100 control socket: close connection fd to avoid leak This patch fixes an fd leak associated with control connections, that are used by syslog-ng-ctl. Reported-By: Jakub Jankowski <shasta@toxcorp.com> Fixed-By: Peter Eisenlohr <peter.eisenlohr@inform-software.com> Signed-off-by: Balazs Scheidler <bazsi@balabit.hu> -- Bazsi
Am 16.01.2012 22:50, schrieb Balazs Scheidler:
The patch below moves the close() call to the destructor function. Can you try if it works the same for you?
commit 3dc36259904aa1b206ee52e6ac2cd1266957cef0 Works fine, no more stale sockets and no crashes, either :) Thank you.
Peter
Tuesday 17 of January 2012 09:19:29 Peter Eisenlohr wrote:
Am 16.01.2012 22:50, schrieb Balazs Scheidler:
The patch below moves the close() call to the destructor function. Can you try if it works the same for you?
commit 3dc36259904aa1b206ee52e6ac2cd1266957cef0
Works fine, no more stale sockets and no crashes, either :) Thank you.
I can confirm this too - works fine. Thank you both. Regards, -- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D
participants (3)
-
Balazs Scheidler
-
Jakub Jankowski
-
Peter Eisenlohr