[syslog-ng] Heavy memory leak using correlation or patterndb

[Balazs Scheidler]

On Wed, 2011-01-26 at 11:01 +0100, Guillaume Rousse wrote:
> Hello.
> 
> Since I installed the rules dedicated to dropping LDAP probe connection
> traces, the memory usage of my ldap server exploded. top confirms than
> syslog-ng is the culprit, using 60% of the available memory. Here is a
> weekly munin graph presenting the issue:
> http://www.zarb.org/~guillomovitch/memory-week.png
> 
> The rules have been installed on 19th, and I restarted syslog-ng yesterday.
> 
> I'm using syslog-ng 3.2.1, on mandriva 2010.0, 64 bits. Here are the
> exact rules used, if that matters (I couldn't try latest Balazs
> suggestions yet). The context-timeout for the first rule is quite low,
> because the probe checks every two seconds. By any chance, doesn't the
> second timeout, set to 0, set an illimited session expiration time ?
> 
> If not the case, I'd gladly try any needed experiment, such as running
> syslog-ng under valgrind, to identify the leak source.

Hmm.. thanks for the report, and sorry for not going after it any
sooner. I'll try to reproduce the problem as no immediate culprit is
visible without reproduction. I hope to get it fixed right after I send
this email, so that hopefully means today.

If not, then I'm not sure when I'll have a chance to work on it
again. :(

-- 
Bazsi