[syslog-ng] high memory usage (swapping)

[Balazs Scheidler]

On Thu, 2009-02-12 at 18:11 +0100, Otto Berger wrote:
> Hi,
> 
> today i got a weird cenario: i rebooted our syslog-ng server and forgot
> to start the syslog-ng daemon. So far so (not) good.
> 
> One of our webservers which sends his logs via UDP to the syslog-server
> became suddenly very slow. It is reproducable: whenever i stop the
> central syslog-server the sender-servers syslog-ng-process gets a very
> high memory usage (4GB!) within seconds... The log-traffic on this
> server is about 30MB/day...
> 
> UDP is a connection-less protocol isnt? ;)
> 
> The configuration of the sender-server:
> 
> -----
> options {
>         sync (0);
>         time_reopen (10);
>         log_fifo_size (1000);
>         long_hostnames (off);
>         use_dns (no);
>         use_fqdn (no);
>         create_dirs (no);
>         keep_hostname (yes);
> };
> 
> source s_sys {
>         file ("/proc/kmsg" log_prefix("kernel: "));
>         unix-stream ("/dev/log");
>         internal();
>         # udp(ip(0.0.0.0) port(514));
> };
> 
> destination a_udp { udp( "example.com" port(514) ); };
> 
> #log { source(s_sys); destination (a_udp); };
> -----
> 
> sender: syslog-ng 2.1.3
> reciever: syslog-ng 2.1.2
> 
> someone got an idea on this issue?

This patch seems to resolve it for me:


commit 13c3a01fea103040c9066037b3deac76925b7777
Author: Balazs Scheidler <bazsi at balabit.hu>
Date:   Fri Feb 27 23:37:47 2009 +0100

    [afsocket] in case of a broken destination connection, set the write fd to NULL
    
    The problem with leaving the destination fd set in this case is that it's
     going to be polled, which in turn will trigger POLLERR again, which in turn
     generates a bunch of messages thus creating a huge memory usage.
    
    Reported-By: Otto Berger

I've fixed this in 3.0 earlier, but I didn't know it applied to 2.1 as
well.

You can find it in tomorrow's snapshot.

-- 
Bazsi