[syslog-ng] syslog-ng 2.0rc1 memory usage

[Balazs Scheidler]

On Thu, 2006-07-20 at 19:47 -0500, Martin, David M wrote:
> Anyone running 2.0rc1 on Solaris 9 (sparc)? 
> If so, what memory requirements are you seeing for the syslog-ng
> process?
> 
> My install handles ~ 700 messages/sec (all UDP) and over the course of
> a day syslog-ng will gradually consume nearly all available free
> memory (I've seen it up to 1GB).
> 
> (syslog-ng is bounced by logrotate daily, so the process repeats
> itself) 
> I was able to substantially decrease the rate of consumption by adding
> the 'flush_lines" global (syslog-ng process now at 91MB and
> growing ... slowly).
> 
> I installed 2.0rc1 on one server, kept another at 1.6.8 (roughly 500
> messages/sec load).  The syslog-ng process there is stable at 3 MB.

I could not reproduce the leak so far locally, although I fixed some
one-off allocation leaks but that should only affect reloads and not
simply running the process.

I suspect this is strict production environment, but I ask anyway, can
you run something like valgrind on the syslog-ng process?

Another idea is to use the built-in leak finder in syslog-ng, it is not
as intrusive but might still help.

If neither of these is possible, I could still use a core file dumped
when syslog-ng is large in size. (I'd need debugging symbols on the
syslog-ng executable as well)

There must be some kind of usage pattern that I miss here, but without
that I cannot fix the problem.

-- 
Bazsi