[syslog-ng]syslog-ng's memory footprint growing constantly
Craig J Constantine
craig@ot.com
Wed, 25 Jul 2001 16:17:06 -0400
Hi,
Basically, the memory size of the process simply grows and grows:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 13899 0.1 19.3 25412 24764 ? S Jul24 2:05 syslog-ng
That was snapped after about 4 hours of run time. If I let it run for
days... well, it once got to 90000 VSZ before the box choked for lack of
RAM. For gauging how heavily worked syslog-ng is, the line counts for all
the files it writes (this is one day of logs) are:
0 UNCAUGHT.messages
180 facility.auth
68 facility.authpriv
1 facility.cron
15651 facility.daemon
1 facility.ftp
0 facility.kern
196 facility.local0
48 facility.local1
1 facility.local2
1 facility.local3
1532 facility.local4
1 facility.local5
1 facility.local6
31 facility.local7
1 facility.lpr
793 facility.mail
1 facility.news
16 facility.syslog
2 facility.user
1 facility.uucp
8818 service.mail
20395 service.popd
4083 service.radiusd
51822 total
and total only about 6Mb in size.
Is there something with internal buffers or garbage collection that I'm
oblivious to? LARTs or terse FAQ pointers welcome... :)
syslog-ng 1.4.11 on Linux (RedHat 6) on Intel with 128M mostly unused.
Configuration is (sorry it's so long):
----------start config-----------
options
{
chain_hostnames(no);
use_fqdn(yes);
create_dirs(yes);
dir_perm(0755);
sync(0);
owner(root);
group(web);
perm(0644);
};
source s_l { unix-stream("/dev/log"); internal(); };
source s_r { udp(ip( REAL_IP_HERE ) port(514)); };
destination local_kern
{
file("/var/log/syslog-ng/current/localhost.kern");
};
destination svc_radiusd
{
file("/var/log/syslog-ng/current/service.radiusd");
};
destination svc_popd
{
file("/var/log/syslog-ng/current/service.popd");
};
destination svc_mail
{
file("/var/log/syslog-ng/current/service.mail");
};
destination fac_auth
{
file("/var/log/syslog-ng/current/facility.auth");
};
destination fac_authpriv
{
file("/var/log/syslog-ng/current/facility.authpriv");
};
destination fac_cron
{
file("/var/log/syslog-ng/current/facility.cron");
};
destination fac_daemon
{
file("/var/log/syslog-ng/current/facility.daemon");
};
destination fac_ftp
{
file("/var/log/syslog-ng/current/facility.ftp");
};
destination fac_kern
{
file("/var/log/syslog-ng/current/facility.kern");
};
destination fac_lpr
{
file("/var/log/syslog-ng/current/facility.lpr");
};
destination fac_mail
{
file("/var/log/syslog-ng/current/facility.mail");
};
destination fac_news
{
file("/var/log/syslog-ng/current/facility.news");
};
destination fac_syslog
{
file("/var/log/syslog-ng/current/facility.syslog");
};
destination fac_user
{
file("/var/log/syslog-ng/current/facility.user");
};
destination fac_uucp
{
file("/var/log/syslog-ng/current/facility.uucp");
};
destination fac_local0
{
file("/var/log/syslog-ng/current/facility.local0");
};
destination fac_local1
{
file("/var/log/syslog-ng/current/facility.local1");
};
destination fac_local2
{
file("/var/log/syslog-ng/current/facility.local2");
};
destination fac_local3
{
file("/var/log/syslog-ng/current/facility.local3");
};
destination fac_local4
{
file("/var/log/syslog-ng/current/facility.local4");
};
destination fac_local5
{
file("/var/log/syslog-ng/current/facility.local5");
};
destination fac_local6
{
file("/var/log/syslog-ng/current/facility.local6");
};
destination fac_local7
{
file("/var/log/syslog-ng/current/facility.local7");
};
destination uncaught
{
file("/var/log/syslog-ng/current/UNCAUGHT.messages");
};
filter f_auth { facility(auth); };
filter f_authpriv { facility(authpriv); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_ftp { facility(ftp); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail); };
filter f_news { facility(news); };
filter f_syslog { facility(syslog); };
filter f_user { facility(user); };
filter f_uucp { facility(uucp); };
filter f_local0 { facility(local0); };
filter f_local1 { facility(local1); };
filter f_local2 { facility(local2); };
filter f_local3 { facility(local3); };
filter f_local4 { facility(local4); };
filter f_local5 { facility(local5); };
filter f_local6 { facility(local6); };
filter f_local7 { facility(local7); };
filter f_pri-gte-notice
{
priority(notice)
or priority(emerg)
or priority(alert)
or priority(crit)
or priority(err)
or priority(warning);
};
filter f_pri-gte-warning
{
priority(emerg)
or priority(alert)
or priority(crit)
or priority(err)
or priority(warning);
};
filter f_pri-gte-err
{
priority(emerg)
or priority(alert)
or priority(crit)
or priority(err);
};
filter f_radiusd
{
program("radiusd");
};
filter f_popd
{
program("popd");
};
# A file for kern facility messages from this host only.
log { source(s_l); filter(f_kern); destination(local_kern); };
# Log paths organizing all entries by facility.
log { source(s_l); source(s_r); filter(f_auth); destination(fac_auth); };
log { source(s_l); source(s_r); filter(f_authpriv);
destination(fac_authpriv); };
log { source(s_l); source(s_r); filter(f_cron); destination(fac_cron); };
log { source(s_l); source(s_r); filter(f_daemon);
destination(fac_daemon); };
log { source(s_l); source(s_r); filter(f_ftp); destination(fac_ftp); };
log { source(s_l); source(s_r); filter(f_kern); destination(fac_kern); };
log { source(s_l); source(s_r); filter(f_lpr); destination(fac_lpr); };
log
{
source(s_l); source(s_r);
filter(f_mail); filter(f_pri-gte-notice);
destination(fac_mail);
};
log
{
source(s_l); source(s_r);
filter(f_mail);
destination(svc_mail);
};
log { source(s_l); source(s_r); filter(f_news); destination(fac_news); };
log { source(s_l); source(s_r); filter(f_syslog);
destination(fac_syslog); };
log { source(s_l); source(s_r); filter(f_user); destination(fac_user); };
log { source(s_l); source(s_r); filter(f_uucp); destination(fac_uucp); };
# LOCAL0 facility is primarily used for POPD information.
log
{
source(s_l); source(s_r);
filter(f_local0); filter(f_pri-gte-notice);
destination(fac_local0);
};
log
{
source(s_l); source(s_r);
filter(f_local0); filter(f_popd);
destination(svc_popd);
};
log { source(s_l); source(s_r); filter(f_local1);
destination(fac_local1); };
log { source(s_l); source(s_r); filter(f_local2);
destination(fac_local2); };
log { source(s_l); source(s_r); filter(f_local3);
destination(fac_local3); };
log { source(s_l); source(s_r); filter(f_local4);
destination(fac_local4); };
# LOCAL5 facility is primarily used for RADIUS information.
log
{
source(s_l); source(s_r);
filter(f_local5); filter(f_pri-gte-notice);
destination(fac_local5);
};
log
{
source(s_l); source(s_r);
filter(f_local5); filter(f_radiusd);
destination(svc_radiusd);
};
log { source(s_l); source(s_r); filter(f_local6);
destination(fac_local6); };
log { source(s_l); source(s_r); filter(f_local7);
destination(fac_local7); };
# Catchall. If anything appears in here, we have something misconfigured.
log { source(s_l); source(s_r); filter(DEFAULT); destination(uncaught); };
----------stop config------------
-Craig