[syslog-ng]syslog-ng's memory footprint growing constantly

[Balazs Scheidler]

On Wed, Jul 25, 2001 at 04:17:06PM -0400, Craig J Constantine wrote:
> Hi,
> 
>   Basically, the memory size of the process simply grows and grows:
> 
> USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND
> root     13899  0.1 19.3 25412 24764 ?       S    Jul24   2:05 syslog-ng
> 
> That was snapped after about 4 hours of run time. If I let it run for 
> days... well, it once got to 90000 VSZ before the box choked for lack of 
> RAM. For gauging how heavily worked syslog-ng is, the line counts for all 
> the files it writes (this is one day of logs) are:
> 
>       0 UNCAUGHT.messages
>     180 facility.auth
>      68 facility.authpriv
>       1 facility.cron
>   15651 facility.daemon
>       1 facility.ftp
>       0 facility.kern
>     196 facility.local0
>      48 facility.local1
>       1 facility.local2
>       1 facility.local3
>    1532 facility.local4
>       1 facility.local5
>       1 facility.local6
>      31 facility.local7
>       1 facility.lpr
>     793 facility.mail
>       1 facility.news
>      16 facility.syslog
>       2 facility.user
>       1 facility.uucp
>    8818 service.mail
>   20395 service.popd
>    4083 service.radiusd
>   51822 total
> 
> and total only about 6Mb in size.
> 
>  Is there something with internal buffers or garbage collection that I'm 
> oblivious to? LARTs or terse FAQ pointers welcome... :)
> 
>   syslog-ng 1.4.11 on Linux (RedHat 6) on Intel with 128M mostly unused. 
> Configuration is (sorry it's so long):

There have been memory leaks, but they were fixed in 1.4.8. To help me to
debug your problem, please compile syslog-ng _AND_ libol with --with-debug
enabled (configure time option), and run syslog-ng with --debug --verbose
switches, and save the resulting output. I'm mainly interested in lines
starting with "Objects alive ... garbage collected...".

If the number after "objects alive" increases then there's some spurious
link within the data structure (the gc frees only unlinked objects), if it
doesn't it is some kind of string data (for example messages).

By setting the core limit to unlimited and sending it a QUIT signal, it
drops core, it could also help to examine the core file whether it contains
messages mostly or binary garbage.

ps: since the last leak problem you are the first one to report something
like this.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1