Thanks guys! Yeah, it seems I need to run it for a while. Let's see if I get the ok for this test and I will report back any result if I get any leak.
Thanks a log, Xavi On 24 October 2014 18:15, Reinoud Koornstra <[email protected]> wrote: > Maybe you need to run it for a longer time as it might build up. Maybe it > depends on the config if you have different ones on different servers? > On Oct 24, 2014 10:12 AM, "Xavier Fustero" <[email protected]> wrote: > > > Hi, > > > > I stopped rsyslogd and started it using valgrind. But as I said, if I > > restart it then it seems to be working fine. Difficult to troubleshooting > > as it happens randomly on the hundred servers we have. I haven not find a > > clear pattern where I can reproduce it. > > > > The Valgrind report says everything looks good. I also run it again using > > --leak-check=full --show-leak-kinds=all but got same positive report. > > > > Thanks Rainer, > > Xavi > > > > ==20795== HEAP SUMMARY: > > ==20795== in use at exit: 14,112 bytes in 181 blocks > > ==20795== total heap usage: 796,711 allocs, 796,530 frees, 540,451,754 > > bytes allocated > > ==20795== > > ==20795== LEAK SUMMARY: > > ==20795== definitely lost: 0 bytes in 0 blocks > > ==20795== indirectly lost: 0 bytes in 0 blocks > > ==20795== possibly lost: 0 bytes in 0 blocks > > ==20795== still reachable: 14,112 bytes in 181 blocks > > ==20795== suppressed: 0 bytes in 0 blocks > > ==20795== Reachable blocks (those to which a pointer was found) are not > > shown. > > ==20795== To see them, rerun with: --leak-check=full > --show-leak-kinds=all > > ==20795== > > ==20795== For counts of detected and suppressed errors, rerun with: -v > > ==20795== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 1 from 1) > > > > On 24 October 2014 17:20, Rainer Gerhards <[email protected]> > > wrote: > > > > > 2014-10-24 16:25 GMT+02:00 Xavier Fustero <[email protected]>: > > > > > > > Hi all, > > > > > > > > we realized that our rsyslogs in production start consuming lot of > > > memory. > > > > This happens randomly and restarting the process it gets back to > > normal. > > > > Today I found one guy consuming 8.5gb! Note that I am talking about > RES > > > > memory, not VIRT. > > > > > > > > top -b -n 1 > > > > > > > > Mem: 17489776k total, 17107728k used, 382048k free, 60144k > > buffers > > > > Swap: 8388604k total, 6564100k used, 1824504k free, 427884k > cached > > > > > > > > PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND > > > > 12464 rs-daemo 20 0 759m 578m 3668 R 76 3.4 70:25.66 ruby > > > > 29254 rs-daemo 20 0 727m 534m 5624 R 39 3.1 1:23.35 ruby > > > > 6005 rs-daemo 20 0 808m 619m 3600 R 37 3.6 213:30.88 ruby > > > > 6007 rs-daemo 20 0 810m 622m 3604 S 25 3.6 1102:55 ruby > > > > 5039 rs-daemo 20 0 89228 26m 928 S 4 0.2 43:32.86 ruby > > > > 4331 root 20 0 9112 1112 836 R 2 0.0 0:00.01 top > > > > 5180 rs-daemo 20 0 89240 26m 916 S 2 0.2 10:07.45 ruby > > > > 5275 rs-daemo 20 0 89128 26m 860 S 2 0.2 12:07.84 ruby > > > > 6107 rs-daemo 20 0 107m 46m 864 S 2 0.3 20:01.43 ruby > > > > 14392 syslog 20 0 15.2g 8.5g 820 S 2 50.9 237:18.47 rsyslogd > > > > .... > > > > > > > > Not sure if this helps but looking at its threads I saw this: > > > > > > > > 6099 rs-daemo 20 0 89228 26m 916 S 0.3 0.2 10:14.67 ruby > > > > 14397 syslog 20 0 15.3g 8.5g 820 S 0.3 51.1 95:50.32 rs:main > > > Q:Reg > > > > 14400 syslog 20 0 15.3g 8.5g 820 S 0.3 51.1 63:23.82 > rs:action > > 9 > > > > que > > > > > > > > We are running rsyslog version 8.4.0 > > > > > > > > root@host:~# rsyslogd -v > > > > > rsyslogd 8.4.0, compiled with: > > > > > FEATURE_REGEXP: Yes > > > > > GSSAPI Kerberos 5 support: No > > > > > FEATURE_DEBUG (debug build, slow code): No > > > > > 32bit Atomic operations supported: Yes > > > > > 64bit Atomic operations supported: Yes > > > > > memory allocator: system default > > > > > Runtime Instrumentation (slow code): No > > > > > uuid support: Yes > > > > > Number of Bits in RainerScript integers: 32 (due to too-old > > json-c > > > > lib) > > > > > > > > > > See http://www.rsyslog.com for more information. > > > > > > > > > > > > > This box is getting logs from several services, writing them locally > > and > > > > fwd to a central rsyslog server. The central rsyslog looks healthy > and > > > > nothing apparently is being queued in this rsyslog. We are using disk > > > > assisted. Not sure on memory but nothing on disk for sure. I paste > > below > > > > few lines from rsyslog-stats: > > > > > > > > Fri Oct 24 14:06:39 2014: imudp(*:514): submitted=0 > > > > > > > > > Fri Oct 24 14:06:39 2014: imudp(*:514): submitted=0 > > > > > Fri Oct 24 14:06:39 2014: resource-usage: utime=6252434752 > > > > > stime=8003212169 maxrss=9156300 minflt=3878658 majflt=712 > > inblock=50224 > > > > > oublock=36923936 nvcsw=368075743 nivcsw=133053533 > > > > > Fri Oct 24 14:06:39 2014: action 1 queue[DA]: size=0 enqueued=0 > > full=0 > > > > > discarded.full=0 discarded.nf=0 maxqsize=0 > > > > > Fri Oct 24 14:06:39 2014: action 1 queue: size=0 enqueued=0 full=0 > > > > > discarded.full=0 discarded.nf=0 maxqsize=0 > > > > > Fri Oct 24 14:06:39 2014: action 9 queue[DA]: size=0 enqueued=0 > > full=0 > > > > > discarded.full=0 discarded.nf=0 maxqsize=0 > > > > > Fri Oct 24 14:06:39 2014: action 9 queue: size=0 enqueued=101932930 > > > > full=0 > > > > > discarded.full=0 discarded.nf=0 maxqsize=902 > > > > > Fri Oct 24 14:06:39 2014: action 10 queue[DA]: size=0 enqueued=0 > > full=0 > > > > > discarded.full=0 discarded.nf=0 maxqsize=0 > > > > > Fri Oct 24 14:06:39 2014: action 10 queue: size=0 enqueued=1360512 > > > full=0 > > > > > discarded.full=0 discarded.nf=0 maxqsize=2375 > > > > > Fri Oct 24 14:06:39 2014: main Q: size=0 enqueued=103293442 full=0 > > > > > discarded.full=0 discarded.nf=0 maxqsize=1044 > > > > > Fri Oct 24 14:06:39 2014: imudp(w0): called.recvmmsg=0 > > called.recvmsg=0 > > > > > msgs.received=0 > > > > > > > > > > > > > so nothing seems queued so far. > > > > > > > > We are using the following template to fwd mssges: > > > > # Templates for logging remotely > > > > template(name="GroupApp" type="string" > > > > string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% > > > > %syslogtag%shard3/daemons:%msg%\n" > > > > ) > > > > > > > > if $syslogfacility-text == 'local0' or $syslogfacility-text == > 'local1' > > > or > > > > $syslogfacility-text == 'local2' then { > > > > action(type="omrelp" target="OUR_SERVER" port="OUR_PORT" > > > > template="GroupApp" > > > > queue.filename="app_queue" > > > > queue.type="linkedlist" > > > > queue.spoolDirectory="/mnt/spool/rsyslog" > > > > queue.highwatermark="8000" > > > > queue.lowwatermark="6000" > > > > queue.maxdiskspace="1g" > > > > queue.timeoutenqueue="0" > > > > queue.saveonshutdown="on" > > > > queue.size="10000" ) > > > > stop > > > > } > > > > > > > > I haven't paste any debug file as if I restart it then the memory > > > > consumption is back to normal. It is happening quite often since we > > moved > > > > from default Ubuntu 12.04 rsyslog5.8 to install rsyslog8.4.0. > > > > > > > > Anyone experienced similar issues? Any idea on how to troubleshooting > > > this? > > > > > > > > > > can you run it under valgrind, at least for a while, so that we can see > > if > > > valgrind reports any memory leaks? It is best to do this in the > > foreground > > > and without auto-backgrounding, just like this: > > > > > > $ sudo valgrind rsyslogd -n ...usual options... > > > > > > After a while, ctl-c out of it and valgrind emits a report. Note that > > there > > > are always some small "leaks", which are things not cleaned up because > > > there is no need to. > > > > > > Rainer > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
