[syslog-ng] [Bug 208] Memory leak when enabling debug logging

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=208





--- Comment #4 from Gergely Nagy <algernon at balabit.hu>  2012-10-27 13:03:01 ---
Hrm. This is - despite the looks of it - not a memory leak, but a feedback loop: enabling debug messages via syslog-ng ctl will trigger an internal message,
which will run through a bunch of filters, each of which triggers more internal messages, which will go through the same filters, tiggering even more messages
- until we run out of memory.

There are a few possible solutions I can see to remedy this situation:

- Internal messages should not generate further internal messages: this has the horrible disadvantage that this makes it impossible to debug where internal
messages and up. So... no go. (It is also awkward to implement)

- Change the config so that internal messages are routed to a separate file, all of them, without filtering. This avoids the problematic situation, but results
in having a completely separate log file for syslog-ng internal messages.

- Internal messages generated by internal messages should not generate further internal messages: this is a variant of the first, but it allows for one set of
child messages, making it possible to debug the flow of internal messages too. The downside is that this is the hardest to implement.

I would suggest going with the second option, at least until a better solution is found. This would mean removing the internal() statement from the s_src
source, and creating a new source, destination & logpath trio:

source s_internal { internal(); } destination d_internal { file("/var/log/syslog-ng.log"); } log { source(s_internal); destination(d_internal); flags(final); }

I'll do that for the next version of the Debian/Ubuntu packages.


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.