[syslog-ng] syslog-ng v3.3.4 on Ubuntu 12.04.2 LTS x_64 has a memory leak

Sandor Geller Sandor.Geller at morganstanley.com
Thu Apr 11 16:30:39 CEST 2013 

Quiting from the NEWS file of 3.3.5:

        Bugfixes:
        =========
        * Fixed a significant memory leak that occurred when the receiver
          side of a syslog connection is slower than syslog-ng. The message
          which we got EAGAIN for got leaked.

        * Fixed another memory leak that caused the complete queue for
          socket based destination drivers to be leaked at reload time.

        * Fixed a memory leak related to handling TLS enabled connections.
          As connections come and go the TLS context wasn't freed.

        * Fixed a small memory leak that occurred when worker threads exit
          (and later start again).

Could you upgrade to a newer version?

On Thu, Apr 11, 2013 at 3:41 PM, Clayton Dukes <cdukes at gmail.com> wrote:
> Hi Guys,
>
> We have some folks doing an audit and they found that syslog-ng is leaking
> memory. This server is processing a steady 8000 events/second, 24 hours a
> day.
>
> syslog-ng is currently using 20GB of memory.
>
>
> Here is their comment:
>
> =====================
>
> I've been watching syslog-ng memory usage and this looks like leaking to me
> (5MB growth every minute):
>
>
>
> root at logzilla:/etc/syslog-ng# while sleep 60; do ps auxw | grep
> /usr/sbin/syslog-ng | grep -v grep; done
>
> root     14004 26.4 20.6 20831384 20462180 ?   Ssl  Apr08 1024:00
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.6 20831384 20467152 ?   Ssl  Apr08 1024:17
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.6 20831384 20472132 ?   Ssl  Apr08 1024:33
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.6 20831384 20477136 ?   Ssl  Apr08 1024:49
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.6 20831384 20481932 ?   Ssl  Apr08 1025:06
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.6 20831384 20486956 ?   Ssl  Apr08 1025:22
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.6 20831384 20491700 ?   Rsl  Apr08 1025:39
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20496688 ?   Ssl  Apr08 1025:55
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20501576 ?   Ssl  Apr08 1026:11
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20506788 ?   Ssl  Apr08 1026:28
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20512480 ?   Ssl  Apr08 1026:44
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20518272 ?   Ssl  Apr08 1026:59
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20522940 ?   Ssl  Apr08 1027:16
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20528268 ?   Ssl  Apr08 1027:32
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20533184 ?   Ssl  Apr08 1027:49
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20538016 ?   Ssl  Apr08 1028:05
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20543132 ?   Ssl  Apr08 1028:22
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20548200 ?   Ssl  Apr08 1028:37
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20553124 ?   Rsl  Apr08 1028:54
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20557940 ?   Ssl  Apr08 1029:10
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20563312 ?   Ssl  Apr08 1029:26
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20568080 ?   Ssl  Apr08 1029:43
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20573176 ?   Ssl  Apr08 1029:59
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20578104 ?   Rsl  Apr08 1030:16
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20583076 ?   Ssl  Apr08 1030:32
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.7 20831384 20588856 ?   Ssl  Apr08 1030:48
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20831384 20594296 ?   Ssl  Apr08 1031:03
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20831384 20599116 ?   Ssl  Apr08 1031:20
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20831384 20604028 ?   Ssl  Apr08 1031:36
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20896920 20608844 ?   Ssl  Apr08 1031:52
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20896920 20613796 ?   Ssl  Apr08 1032:08
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20896920 20618956 ?   Ssl  Apr08 1032:25
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20896920 20624292 ?   Ssl  Apr08 1032:41
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20896920 20629372 ?   Ssl  Apr08 1032:57
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20896920 20634284 ?   Ssl  Apr08 1033:13
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20896920 20639608 ?   Ssl  Apr08 1033:29
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20896920 20644384 ?   Rsl  Apr08 1033:45
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20896920 20649440 ?   Rsl  Apr08 1034:02
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20962456 20654116 ?   Ssl  Apr08 1034:18
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20962456 20659368 ?   Rsl  Apr08 1034:34
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20962456 20665300 ?   Ssl  Apr08 1034:50
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 20962456 20671644 ?   Ssl  Apr08 1035:05
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 21027992 20676440 ?   Rsl  Apr08 1035:22
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 21027992 20681116 ?   Ssl  Apr08 1035:38
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.8 21027992 20686220 ?   Ssl  Apr08 1035:54
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21027992 20691032 ?   Ssl  Apr08 1036:11
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21027992 20696044 ?   Ssl  Apr08 1036:27
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21027992 20700944 ?   Rsl  Apr08 1036:43
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21027992 20705760 ?   Ssl  Apr08 1037:00
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21027992 20710540 ?   Rsl  Apr08 1037:18
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21027992 20715696 ?   Ssl  Apr08 1037:34
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21027992 20720316 ?   Ssl  Apr08 1037:51
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21027992 20725632 ?   Ssl  Apr08 1038:07
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20730196 ?   Ssl  Apr08 1038:24
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20735636 ?   Ssl  Apr08 1038:39
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20741476 ?   Ssl  Apr08 1038:56
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20749860 ?   Ssl  Apr08 1039:10
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20755808 ?   Ssl  Apr08 1039:24
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20761004 ?   Ssl  Apr08 1039:40
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20766152 ?   Ssl  Apr08 1039:57
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20771220 ?   Ssl  Apr08 1040:14
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20776268 ?   Ssl  Apr08 1040:30
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20781116 ?   Ssl  Apr08 1040:47
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 20.9 21028120 20786176 ?   Ssl  Apr08 1041:03
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 21.0 21159192 20791412 ?   Ssl  Apr08 1041:19
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 21.0 21159192 20796124 ?   Ssl  Apr08 1041:36
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 21.0 21159192 20801112 ?   Ssl  Apr08 1041:53
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> root     14004 26.4 21.0 21159192 20805952 ?   Rsl  Apr08 1042:10
> /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
>
> ______________________________________________________________
>
> Clayton Dukes
> ______________________________________________________________
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>

More information about the syslog-ng mailing list