Hi, Some more information about the memory leak. The last fix seems to have fixed for others. Thanks for the report Bryan. So as it seems the spoof related memory leak seems to have been fixed by my last patch. Henry's problem seems to be related but a different bug either in syslog-ng or in libnet. -------- Forwarded Message --------

From: Ignatow, Bryan <Bryan.Ignatow@acs-inc.com> To: Balazs Scheidler <bazsi@balabit.hu> Subject: RE: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP logs Date: Fri, 4 Mar 2005 11:57:46 -0600

A private reply - my home e-mail address is subscribed, not my work. Feel free to forward to the list.

We use syslog-ng on some very busy Syslog servers. About 1M logs a day on average on the largest one. We UDP forward with spoofing over 300K of those messages a day on average.

We have been seeing memory problems since we first implemented 1.6.4, and I recently upgraded to 1.6.6. and libol 0.3.15 (from 0.3.13) and have been using libnet 1.1.2.1. We compile from source. The system is a Fedora Core 1 reasonably fully patched, running 2.4.22-1.2199.nptlsmp on a dual HyperThreaded P4 3GHz with 2 GB of memory. Well... I am not sure if they were memory leaks, but the process would keel over when it reached about 3GB of virtual (2GB resident) in size. Restarting the process would clear the memory problem.

I decided since the upgrade to 1.6.6 didn't fix it, I would subscribe to the mailing list and see what was out there (a shocking concept I know... but I am a maverick). That is where I ran across this thread.

I saw the note in the archive from Feb 28th with the patch to afinet.c adding the "ol_string_free(msg_line);" line I gave this a shot and it has really helped. We are holding steady at:

PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND 4316 root 15 0 1220 1216 756 S 0.0 0.0 5:33 0 syslog-ng

We started somewhere around 1023K resident and have not moved up hardly at all in the 4 days since we put this code in place. Before we were moving up 8K every 2 seconds.

Hope this helps,

Bryan

-----Original Message----- From: syslog-ng-admin@lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Friday, March 04, 2005 11:20 AM To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP logs

-- Bazsi