[syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP logs
syslog-ng@lists.balabit.hu
syslog-ng@lists.balabit.hu
Wed, 2 Mar 2005 09:45:22 -0500
This is a multipart message in MIME format.
--=_alternative 00512A9485256FB8_=
Content-Type: text/plain; charset="US-ASCII"
Let me understand this, you were seeing a leak when using a PERL script to
send UDP packets using
Net::RawIP _to_ syslong_ng.
I am still experiencing clear leak behavior when using syslog-ng to send
spoffed UDP packets to other syslog-ng's.
The syslog-ng sender is leaking, the receiver is exhibitning normal
behavior.
syslog-ng-admin@lists.balabit.hu wrote on 03/02/2005 08:42:23 AM:
> CORRIGENDUM:
>
> > It looks very much like a leak. As I've heard last week from our
> > development team, they seem to have seen similar massive leaks when
> > using UDP spoofing. But I need to confirm that first. I'll let you
know
> > tomorrow or the latest by next Wednesday.
>
> Ok, I've checked back again with that developer and ...
>
> > The leak manifested itself when calling syslog() over a perl script or
> > something similar, I don't exactly remember. The gross and I/O
intesive
>
> Actually it was a bug in the Perl Module Net::RawIP. We needed
> specially crafted
> UDP packets for sending them to syslog-ng. So my barking is wrong
> here and I do
> _NOT_ see this memory leak. Sorry for the noise and happy debugging :).
>
> Regards,
> Roberto Nibali, ratz
> --
> -------------------------------------------------------------
> addr://Rathausgasse 31, CH-5001 Aarau tel://++41 62 823 9355
> http://www.terreactive.com fax://++41 62 823 9356
> -------------------------------------------------------------
> terreActive AG Wir sichern Ihren Erfolg
> -------------------------------------------------------------
> _______________________________________________
> syslog-ng maillist - syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>
--=_alternative 00512A9485256FB8_=
Content-Type: text/html; charset="US-ASCII"
<br><font size=2 face="sans-serif">Let me understand this, you were seeing
a leak when using a PERL script to send UDP packets using </font>
<br><font size=2 face="sans-serif">Net::RawIP _to_ syslong_ng.</font>
<br>
<br><font size=2 face="sans-serif">I am still experiencing clear leak behavior
when using syslog-ng to send spoffed UDP packets to other syslog-ng's.
</font>
<br><font size=2 face="sans-serif">The syslog-ng sender is leaking, the
receiver is exhibitning normal behavior.</font>
<br>
<br><font size=2><tt>syslog-ng-admin@lists.balabit.hu wrote on 03/02/2005
08:42:23 AM:<br>
<br>
> CORRIGENDUM:<br>
> <br>
> > It looks very much like a leak. As I've heard last week from
our<br>
> > development team, they seem to have seen similar massive leaks
when<br>
> > using UDP spoofing. But I need to confirm that first. I'll let
you know<br>
> > tomorrow or the latest by next Wednesday.<br>
> <br>
> Ok, I've checked back again with that developer and ...<br>
> <br>
> > The leak manifested itself when calling syslog() over a perl
script or<br>
> > something similar, I don't exactly remember. The gross and I/O
intesive<br>
> <br>
> Actually it was a bug in the Perl Module Net::RawIP. We needed <br>
> specially crafted<br>
> UDP packets for sending them to syslog-ng. So my barking is wrong
<br>
> here and I do<br>
> _NOT_ see this memory leak. Sorry for the noise and happy debugging
:).<br>
> <br>
> Regards,<br>
> Roberto Nibali, ratz<br>
> -- <br>
> -------------------------------------------------------------<br>
> addr://Rathausgasse 31, CH-5001 Aarau tel://++41 62 823 9355<br>
> http://www.terreactive.com
fax://++41 62 823 9356<br>
> -------------------------------------------------------------<br>
> terreActive AG
Wir sichern Ihren Erfolg<br>
> -------------------------------------------------------------<br>
> _______________________________________________<br>
> syslog-ng maillist - syslog-ng@lists.balabit.hu<br>
> https://lists.balabit.hu/mailman/listinfo/syslog-ng<br>
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html<br>
> <br>
</tt></font>
--=_alternative 00512A9485256FB8_=--