[syslog-ng] syslog-ng Potential Memory Leak

[Tamayo, Andres]

Hello,

Sorry, I should have been given out more information when I described my test.  

I am actually using flow-control in the test I described before.  I have set the log_fifo_size to 250 logs so the syslog-ng client daemon stops buffering logs after 250 have been received.  flags(flow-control) is also set in the configuration log definition.  I have checked that flow-control is working correctly because after I bring the syslog-ng server back online, all the logs sent for 4 hours get delivered to the server.  So no logs are been dropped after 250 logs have been buffered.  

For that reason, I do not believe this is the reason why the syslog-ng client daemon virtual memory size continuously increase when the syslog-ng server is not online.

Thanks.


-----Original Message-----
From: Jakub Jankowski [mailto:shasta at toxcorp.com] 
Sent: Wednesday, March 19, 2014 4:24 PM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] syslog-ng Potential Memory Leak

On 19.03.2014 23:13, Tamayo, Andres wrote:
> Hello,
>
> I have been testing syslog-ng under different scenarios and I noticed 
> that when syslog-ng is trying to connect to an external syslog-ng 
> server, it exhibits what could be called a memory leak.
>
> Let me explain how I am setting up my test.  I have a syslog-ng client 
> running collecting logs from a file (source) and sending them to an 
> external syslog-ng server over TCP (destination).  If the syslog-ng 
> server is online, the syslog-ng client daemon process virtual memory 
> does not increase. Now, when I kill the syslog-ng server, the 
> syslog-ng client daemon process starts to request more and more virtual memory.
[...]

What you're seeing is not a memory leak. Syslog-ng memory usage grows, because it maintains an output buffer, in which it stores messages if the destination becomes unavailable. Size of this buffer is controlled by log_fifo_size() config option.

Read more about it in the docs: 
https://urldefense.proofpoint.com/v1/url?u=http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/en/syslog-ng-ose-v3.3-guide-admin-en/html-single/index.html&k=OWT%2FB14AE7ysJN06F7d2nQ%3D%3D%0A&r=o7GqWGDQQvuJbgvvR6T88i9N1FvBWrMPYBwWrEtosko%3D%0A&m=4KAHhE8ohdAJ3Juf5i0AcvX1Su75VkBhUHNZeUzQ4Os%3D%0A&s=f8a636f3ec8abfdf56791668a1a117bfb2e5d1db00bee966b4f1450f91a21e48


HTH

--
Jakub Jankowski|shasta at toxcorp.com|https://urldefense.proofpoint.com/v1/url?u=http://toxcorp.com/&k=OWT%2FB14AE7ysJN06F7d2nQ%3D%3D%0A&r=o7GqWGDQQvuJbgvvR6T88i9N1FvBWrMPYBwWrEtosko%3D%0A&m=4KAHhE8ohdAJ3Juf5i0AcvX1Su75VkBhUHNZeUzQ4Os%3D%0A&s=db9b84f5e8e1c56dfdc5d919aecc6e47182cf1709c24ce18cf8bb883d4018582
GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D