[syslog-ng] why dose the usage of mem by syslog-ng keep growing?

[Geller, Sandor (IT)]

Hello, 

>  the configure file  as follows: 
> 
> options { use_dns(no); create_dirs(yes);ts_format(iso); }; 
> 
> #options { log_fifo_size(3000); };
> 
> source src { udp(ip(0.0.0.0) port(514) ); };
> 
>  
> 
> filter f_kern { facility(kern); };
> 
> filter f_authpriv { facility(auth,authpriv); };
> 
> filter f_mail { facility(mail); };
> 
> filter f_cron { facility(cron); };
> 
> filter f_boot { facility(local7); };
> 
> filter f_spooler { facility(uucp, news) and level(crit..emerg); };
> 
> filter f_messages { level(info..emerg) and not 
> facility(authpriv, cron, mail); };
> 
>  
> 
> destination kern { 
> file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); };
> 
> destination authpriv { 
> file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); };
> 
> destination mail { 
> file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); };
> 
> destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); };
> 
> destination boot { 
> file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); };
> 
> destination spooler { 
> file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); };
> 
> destination messages { 
> file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); };
> 
>  
> 
>  
> 
> log { source(src); filter(f_kern); destination(kern); };
> 
> log { source(src); filter(f_authpriv); destination(authpriv); };
> 
> log { source(src); filter(f_mail); destination(mail); };
> 
> log { source(src); filter(f_cron); destination(cron); };
> 
> log { source(src); filter(f_boot); destination(boot); };
> 
> log { source(src); filter(f_spooler); destination(spooler); };
> 
> log { source(src); filter(f_messages); destination(messages); };
> 
> syslog-ng receive logs from about 1000 clients ,and the usage 
> of mem by syslog-ng keeps growing,here are a days record of 
> the usage of mem(got by command 'ps aux'):
> 
> cup %mem
> 
> 0.1 29.9
> 
> 0.1 30.1
> 
> 0.1 30.3
> 
> 0.1 30.5
> 
> 0.1 30.7
> 
> 0.1 30.9
> 
> 0.1 31.1
> 
> 0.1 31.2
> 
> 0.1 31.4
> 
> 0.1 31.6
> 
> 0.1 31.9
> 
> 0.1 32.1
> 
> 0.1 32.3
> 
> 0.1 32.4
> 
> 0.1 32.6
> 
> 0.1 32.8
> 
> 0.1 33.0
> 
> 0.1 33.2
> 
> 0.1 33.4
> 
> 0.1 33.5
> 
> 0.1 33.8
> 
> 0.1 33.9
> 
> 0.1 34.1
> 
> 0.1 34.3
> 
> 0.1 34.5
> 
> 0.1 34.6
> 
> 0.1 34.9
> 
> 0.1 35.0
> 
> 0.1 35.2

There was a similar thread a few days ago. Could you check whether
the the memory usage actually grows when every destinations hit
their configured log_fifo_size() values which default to 1000?

It would be much better if you could show the actual memory
footprint of syslog-ng, see the RSS column of ps's output.

Regards,

Sandor
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.