Can you run it under valgrind for a short while? Upon termination, it should show details on a potential memory leak.
Rainer Sent from phone, thus brief. Am 30.10.2016 22:07 schrieb "matthew.gaetano" <[email protected]>: > Hello, > > After recently deciding to go with Liblognorm to perform parsing tasks over > cumbersome heavy weighted regular expression and java based processing we > hit a snag with our config. For the last few weeks we have been > troubleshooting why rsyslog was consuming all available memory on the > server. We eventually isolated it to the action mmnormalize, and further > down into a specific function of liblognorm known as "User Defined Types" > (UDT). At first we thought this might be related to load as during the day > were were handling 50-70K EPS but the testing over the weekend demonstrates > the issue is still prevalent at lower EPS values (7-10K). To be honest were > not too sure were to go from here hence bringing it up on the rsyslog > mailing list to see if others are having similar problems. For the most > part > we will likely just work around the problem for the time being by simply > not > using UDTs. The following demonstrates the isolated config testing: > > Rsyslog Version: 8.22.0 > Liblognrom Version: 2.0.1 > OS: Cent OS 7 3.10.0-327.36.1.el7.x86_64 > > rsyslog configuration: > module(load="mmnormalize") > ruleset( > name="test" > queue.type="direct" > ){ > > action( > name="test" > type="mmnormalize" > ruleBase="/etc/rsyslog.r/test.rb" > path="$!test" > useRawMsg="on" > ) > > # Complete processing > stop > > } > > module(load="imptcp" Threads="7" processOnPoller="off") > input( > type="imptcp" > port="20000" > compression.mode="stream:always" > ruleset="test" > KeepAlive="on" > KeepAlive.Probes="2" > KeepAlive.Interval="30" > KeepAlive.Time="60" > NotifyOnConnectionClose="on" > ) > > Test 001 Rule Base: > version=2 > prefix= > #Test 001 (Possible Memory leak, will eventually consume all memory on the > server) > type=@test:%{ > "type":"alternative", > "parser": [ > {"type":"literal", "text":"test123"}, > {"type":"literal", "text":"123test"} > ] > }% > rule=:%test:@test% > > > Test 002 Rule Base: > version=2 > prefix= > #Test 002 (Does not consume all memory on server, stays relatively low) > rule=:%test:{ > "type":"alternative", > "parser": [ > {"type":"literal", "text":"test123"}, > {"type":"literal", "text":"123test"} > ] > }% > > > Test 003 Rule Base: > version=2 > prefix= > #Test 003 (Possible Memory leak, will eventually consume all memory on the > server) > type=@test:%ip:ipv4% > rule=:%test:@test% > > > Test 004 Rule Base: > version=2 > prefix= > #Test 004 (Possible Memory leak, will eventually consume all memory on the > server) > type=@test:test123 > type=@test:123test > rule=:%test:@test% > > > > We are still in development and have additional resources to continue > testing should there be more questions or troubleshooting others would like > to suggest. We can provide rsyslog debug but were not to sure how helpful > that will be as its liblognorm having the issue. > > Thank you > > ~Best Regards > > Matthew Gaetano > > > > -- > View this message in context: http://rsyslog-users.1305293. > n2.nabble.com/Liblognorm-User-Defined-Types-Memory-Leak-tp7591408.html > Sent from the rsyslog-users mailing list archive at Nabble.com. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
