[syslog-ng] Heavy memory leak using correlation or patterndb

[Guillaume Rousse]

Hello.

Since I installed the rules dedicated to dropping LDAP probe connection
traces, the memory usage of my ldap server exploded. top confirms than
syslog-ng is the culprit, using 60% of the available memory. Here is a
weekly munin graph presenting the issue:
http://www.zarb.org/~guillomovitch/memory-week.png

The rules have been installed on 19th, and I restarted syslog-ng yesterday.

I'm using syslog-ng 3.2.1, on mandriva 2010.0, 64 bits. Here are the
exact rules used, if that matters (I couldn't try latest Balazs
suggestions yet). The context-timeout for the first rule is quite low,
because the probe checks every two seconds. By any chance, doesn't the
second timeout, set to 0, set an illimited session expiration time ?

If not the case, I'd gladly try any needed experiment, such as running
syslog-ng under valgrind, to identify the leak source.

-- 
BOFH excuse #400:

We are Microsoft.  What you are experiencing is not a problem; it is an
undocumented feature.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ldap_probe.pdb
Type: application/vnd.palm
Size: 1318 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110126/6d28eb20/attachment.bin