[syslog-ng] Possible memleak in 3.3 HEAD

[Jakub Jankowski]

On Fri, 14 Oct 2011 01:39:28 +0200, Jakub Jankowski wrote:
> On Thu, 13 Oct 2011 15:32:27 +0200, Balazs Scheidler wrote:
> 
> Since upgrading to 3.3.1, there is a strange behaviour of my system: if I
> reload syslog-ng, it spits out *tons* of similar messages:
> Internal error, duplicate configuration elements refer to the same
> persistent config; name='dd_queue(d_mesg,d_mesg#0)'
> 
> As far as I can tell, this happens for every destination that was open:
> $ grep '^Oct 14 00:00:03' /var/log/messages | grep -c
> 'dd_queue(d_mesg,d_mesg#0)' 186 
> $ grep '^Oct 14 00:00:03' /var/log/messages | grep -c
> 'dd_queue(d_cron,d_cron#0)' 164
> $ grep '^Oct 14 00:00:03' /var/log/messages | grep -c '_errorlog#0'
> 62435
> 
> I'm pretty sure there are no duplicate configuration elements in my config,
> especially for those "standard" ones like d_mesg or d_cron:
> 
> $ grep d_mesg /etc/syslog-ng/syslog-ng.conf
> destination d_mesg { file("/var/log/messages" group("root")
> flush_lines(1)); }; log { source(s_sys); filter(f_default);
> destination(d_mesg); }; $ grep messages /etc/syslog-ng/syslog-ng.conf
> destination d_mesg { file("/var/log/messages" group("root")
> flush_lines(1)); }; $
> 
> If there were, I'd get some errors at startup, right? Well, I don't.
> 
> But what's most peculiar, is that after such reload, VmRSS stays roughly the
> same (at least it's not climbing like crazy).
> 
> > I've also read the complete log and I've found two minor leaks, both of
> > which leak memory when processing SIGHUPs, I've fixed these:
> 
> I've built a package with these two patches applied, and run it on my test
> system, to confirm this weird behaviour above. It still manifests.
> After a clean start, until there are logs to process, I can reload syslog-ng
> and there are no "Internal error" messages. As soon as I make my log relays
> send some messages to this test system, and try to reload it: boom, internal
> errors again.
> 
> This is very weird, I don't recall this behaviour before. I know this
> description isn't the most precise one, but at this moment I had no time to
> investigate more. I promise I'll dig some more during next few days.
> But maybe even this much will help someone debug it.

Ok, at least I managed to get valgrind output from SIGHUP processing. It's
avaliable at http://toxcorp.com/stuff/syslog-ng-leak/s3.3.1-head-HUP.log
This is for 3.3.1 with recent SIGHUP-leak-related patches applied.

==13436== LEAK SUMMARY:
==13436==    definitely lost: 83,795 bytes in 1,698 blocks
==13436==    indirectly lost: 1,012 bytes in 21 blocks
==13436==      possibly lost: 13,153 bytes in 108 blocks
==13436==    still reachable: 80,050 bytes in 3,278 blocks
==13436==         suppressed: 0 bytes in 0 blocks

But still I don't get why all of the sudden, "duplicate configuration
elements" are logged on SIGHUP, but:
- not on start
- not if SIGHUP was received prior to any remote message


Regards,

-- 
Jakub Jankowski|shasta at toxcorp.com|http://toxcorp.com/
GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D