[syslog-ng] memory exhausted in /opt/syslog-ng/etc/syslog-ng.conf at line 5347

Patrick H. syslogng at feystorm.net
Tue Nov 9 02:16:29 CET 2010 

The only other case I can think that would cause this is an internal 
limit in the code that prevents it from using more than a certain 
amount, and that I have no clue about.

-possibly...but how come the older versions of syslog-ng work?  Maybe a 
new addition to syslog-ng-3.0.
A likely case is that whatever structures syslog-ng uses for parsing out 
config options grew in size. Like if the structure for a 'filter' config 
directive grew from 30 bytes to 36 bytes, and you have that in your 
config hundreds of times, then its making it use a lot more memory. But 
thats just a theory.

-Patrick


Sent: Mon Nov 08 2010 17:57:04 GMT-0700 (Mountain Standard Time)
From: Mukarram Syed <msyed at walmart.com>
To: Syslog-ng users' and developers' mailing list 
<syslog-ng at lists.balabit.hu>
Subject: Re: [syslog-ng] memory exhausted in 
/opt/syslog-ng/etc/syslog-ng.conf at line 5347
>
> I imagine a config that large has got to make syslog-ng really slow, 
> and I cant imagine why it would need to be that large in the first place.
> -its pulling syslog info from about 1500 servers.
>
>  
>
> Do you have any sort of ulimit in place controlling memory? (ulimit -m 
> on most shells)
>
> # ulimit -m
>
> Unlimited
>
>  
>
> Are you actually running out of memory (watch top while the process is 
> starting up)?
> -I haven't tried that...it's a good idea though.
>
>  
>
> The only other case I can think that would cause this is an internal 
> limit in the code that prevents it from using more than a certain 
> amount, and that I have no clue about.
>
> -possibly...but how come the older versions of syslog-ng work?  Maybe 
> a new addition to syslog-ng-3.0.
>
>  
>
> Thanks
>
>  
>
> # mukarram
>
> *From:* syslog-ng-bounces at lists.balabit.hu 
> [mailto:syslog-ng-bounces at lists.balabit.hu] *On Behalf Of *Patrick H.
> *Sent:* Monday, November 08, 2010 4:41 PM
> *To:* Syslog-ng users' and developers' mailing list
> *Subject:* Re: [syslog-ng] memory exhausted in 
> /opt/syslog-ng/etc/syslog-ng.conf at line 5347
>
>  
>
> I imagine a config that large has got to make syslog-ng really slow, 
> and I cant imagine why it would need to be that large in the first place.
> Do you have any sort of ulimit in place controlling memory? (ulimit -m 
> on most shells)
> Are you actually running out of memory (watch top while the process is 
> starting up)?
> The only other case I can think that would cause this is an internal 
> limit in the code that prevents it from using more than a certain 
> amount, and that I have no clue about.
>
> -Patrick
>
> Sent: Mon Nov 08 2010 17:33:35 GMT-0700 (Mountain Standard Time)
> From: Mukarram Syed <msyed at walmart.com> <mailto:msyed at walmart.com>
> To: Syslog-ng users' and developers' mailing list 
> <syslog-ng at lists.balabit.hu> <mailto:syslog-ng at lists.balabit.hu>
> Subject: Re: [syslog-ng] memory exhausted in 
> /opt/syslog-ng/etc/syslog-ng.conf at line 5347
>
> I was migrating from syslog-ng-1.6 to a new version of syslog-ng in a 
> veritas cluster.  The original config file has >5000 lines and we want 
> to keep it that way since it's Production.
>
> I got around it using syslog-ng-2.0 but 3.0 did not work due to this 
> error.
>
>  
>
> Thanks for the response.
>
>  
>
> # mukarram
>
>  
>
> *From:* syslog-ng-bounces at lists.balabit.hu 
> <mailto:syslog-ng-bounces at lists.balabit.hu> 
> [mailto:syslog-ng-bounces at lists.balabit.hu] *On Behalf Of *Patrick H.
> *Sent:* Monday, November 08, 2010 4:31 PM
> *To:* Syslog-ng users' and developers' mailing list
> *Subject:* Re: [syslog-ng] memory exhausted in 
> /opt/syslog-ng/etc/syslog-ng.conf at line 5347
>
>  
>
> You seriously have a config thats 5000+ lines??? May I ask why?
>
> -Patrick
>
> Sent: Mon Nov 08 2010 16:54:45 GMT-0700 (Mountain Standard Time)
> From: Mukarram Syed <msyed at walmart.com> <mailto:msyed at walmart.com>
> To: 'syslog-ng at lists.balabit.hu <mailto:syslog-ng at lists.balabit.hu>' 
> <syslog-ng at lists.balabit.hu> <mailto:syslog-ng at lists.balabit.hu>
> Subject: [syslog-ng] memory exhausted in 
> /opt/syslog-ng/etc/syslog-ng.conf    at line 5347
>
> Hi ,
>
> I am getting the following error when starting syslog-ng.conf file 
> which has more than 5000 lines in it and getting the following error:
>
>  
>
> # service syslog-ng start
>
> memory exhausted in /opt/syslog-ng/etc/syslog-ng.conf at line 5347.
>
>  
>
> syslog-ng documentation: 
> http://www.balabit.com/support/documentation/?product=syslog-ng
>
> mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>
>                                                          [FAILED]
>
>  
>
>  
>
> When I truncate the file to < 5000 lines it starts up fine.
>
>  
>
> This is running version syslog-ng-3.0.8-1.rhel5.x86_64
>
> Mailing list does not have any clues to it.
>
> Anything in the syslog-ng.conf file that needs to be done to accept 
> more lines?
>
> Any ideas would be appreciated.
>
>  
>
> Thanks
>
>  
>
> # mukarram
>
>  
>
> *Mukarram Syed*
>
>  
>
>  
>  
> ------------------------------------------------------------------------
>
>
>   
>  
>  
>   
>  
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>  
>   
>  
> ------------------------------------------------------------------------
>
>
>   
>  
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>  
>   
> ------------------------------------------------------------------------
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20101108/5f3e8ab4/attachment-0001.htm

More information about the syslog-ng mailing list