Hello,
After recently deciding to go with Liblognorm to perform parsing tasks over
cumbersome heavy weighted regular expression and java based processing we
hit a snag with our config. For the last few weeks we have been
troubleshooting why rsyslog was consuming all available memory on the
server. We eventually isolated it to the action mmnormalize, and further
down into a specific function of liblognorm known as "User Defined Types"
(UDT). At first we thought this might be related to load as during the day
were were handling 50-70K EPS but the testing over the weekend demonstrates
the issue is still prevalent at lower EPS values (7-10K). To be honest were
not too sure were to go from here hence bringing it up on the rsyslog
mailing list to see if others are having similar problems. For the most part
we will likely just work around the problem for the time being by simply not
using UDTs. The following demonstrates the isolated config testing:
Rsyslog Version: 8.22.0
Liblognrom Version: 2.0.1
OS: Cent OS 7 3.10.0-327.36.1.el7.x86_64
rsyslog configuration:
module(load="mmnormalize")
ruleset(
name="test"
queue.type="direct"
){
action(
name="test"
type="mmnormalize"
ruleBase="/etc/rsyslog.r/test.rb"
path="$!test"
useRawMsg="on"
)
# Complete processing
stop
}
module(load="imptcp" Threads="7" processOnPoller="off")
input(
type="imptcp"
port="20000"
compression.mode="stream:always"
ruleset="test"
KeepAlive="on"
KeepAlive.Probes="2"
KeepAlive.Interval="30"
KeepAlive.Time="60"
NotifyOnConnectionClose="on"
)
Test 001 Rule Base:
version=2
prefix=
#Test 001 (Possible Memory leak, will eventually consume all memory on the
server)
type=@test:%{
"type":"alternative",
"parser": [
{"type":"literal", "text":"test123"},
{"type":"literal", "text":"123test"}
]
}%
rule=:%test:@test%
Test 002 Rule Base:
version=2
prefix=
#Test 002 (Does not consume all memory on server, stays relatively low)
rule=:%test:{
"type":"alternative",
"parser": [
{"type":"literal", "text":"test123"},
{"type":"literal", "text":"123test"}
]
}%
Test 003 Rule Base:
version=2
prefix=
#Test 003 (Possible Memory leak, will eventually consume all memory on the
server)
type=@test:%ip:ipv4%
rule=:%test:@test%
Test 004 Rule Base:
version=2
prefix=
#Test 004 (Possible Memory leak, will eventually consume all memory on the
server)
type=@test:test123
type=@test:123test
rule=:%test:@test%
We are still in development and have additional resources to continue
testing should there be more questions or troubleshooting others would like
to suggest. We can provide rsyslog debug but were not to sure how helpful
that will be as its liblognorm having the issue.
Thank you
~Best Regards
Matthew Gaetano
--
View this message in context:
http://rsyslog-users.1305293.n2.nabble.com/Liblognorm-User-Defined-Types-Memory-Leak-tp7591408.html
Sent from the rsyslog-users mailing list archive at Nabble.com.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
