Package: syslog-ng
Version: 3.3.9-1
We have encountered a significant memory leak in syslog-ng when used in
our environment.
We leak around 120MB per day, causing us to restart our syslog-ng.
The bug can be reproduced with the following syslog-ng configuration
file (not 100% sure which options are vital from our environment. All
have been included).
################################################################################
# BEGIN syslog-ng.conf
################################################################################
@version: 3.3
filter f_first8_a {
match("^(?<msg_tag>[a-z0-9A-Z_\-]{0,8})(?<msg_bits>.*)" value("PROGRAM")
type("pcre") flags("store-matches")); };
rewrite first_eight_chars_a {
set("${msg_tag}", value("PROGRAM"));
set("${msg_bits} ${MESSAGE}", value("MESSAGE"));
};
template t_default {
template("$R_ISODATE $HOST $PROGRAM $MESSAGE\n");
};
options
{
chain_hostnames(0);
time_reopen(1);
time_reap(5);
flush_lines(0);
# log_fifo_size(8192);
create_dirs(yes);
perm(0644);
dir_perm(0755);
use_dns(yes);
dns_cache(yes);
dns_cache_expire(600);
dns_cache_expire_failed(60);
dns_cache_size(500);
log_msg_size(8192);
stats_freq(3600);
bad_hostname("^gconfd$");
keep_hostname(yes);
ts_format("iso");
keep_timestamp(no);
frac_digits(3);
};
source s_sys
{
file ("/proc/kmsg"
program_override("kernel: "));
unix-stream ("/dev/log");
internal();
udp(ip(0.0.0.0) port(514));
};
destination d_sys
{
file("/tmp/syslog-ng/test/${HOST}_${PROGRAM}-messages.log");
};
log
{
source(s_sys);
filter(f_first8_a);
rewrite(first_eight_chars_a);
destination(d_sys);
};
################################################################################
# END syslog-ng.conf
################################################################################
The leak can be recreated with the following script:
################################################################################
# BEGIN genleak.sh
################################################################################
#!/bin/bash
x=0
tag_arr=(11111111 22222222 33333333 44444444 55555555 66666666 77777777
88888888 99999999 00000000)
while :; do
let x=$x+1
if [[ x -eq 10 ]]; then
x=0
# NOTE: This value works best at 6, so that syslog-ng
releases
# and recreates the memory allocated to the file handles
# frequently.
sleep 6
fi
logger -t ${tag_arr[$x]}MyPayload and some extra data as well
done
################################################################################
# END genleak.sh
################################################################################
