[Syslog-ng-maintainers] Bug#727649: Status of fix?

Johnson, Chris (HP TippingPoint Roseville) chris.johnson3 at hp.com
Sun Apr 12 00:43:04 BST 2015

I've got syslog-ng ose 3.5.6 loaded and it looks like I'm being affected by this defect.
I use the 'rewrite{set()} extensively, and when we were stress testing our product (of which syslog-ng is the logging component) it was noticed that syslog-ng grew by 2.6M after only 1000 sigHUPs.

A valgind run shows a big chunk of that increase was 'lost' in one routine (log_rewrite_set_new):

==30140== 1,701,661 (1,254,272 direct, 447,389 indirect) bytes in 9,799 blocks are definitely lost in loss record 3,202 of 3,202
==30140==    at 0x4C29619: calloc (vg_replace_malloc.c:593)
==30140==    by 0x66EA7FD: g_malloc0 (in /usr/local/lib/libglib-2.0.so.0.3000.1)
==30140==    by 0x66EA8A0: g_malloc0_n (in /usr/local/lib/libglib-2.0.so.0.3000.1)
==30140==    by 0x62443A4: log_rewrite_set_new (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x624432F: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x620186D: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x620245B: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x6203073: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x6202A51: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x62030B6: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x62028E7: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x6203096: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x6202A51: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x62030B6: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x6203155: cfg_tree_compile_rule (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x6203488: cfg_tree_compile (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x62034CC: cfg_tree_start (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x61FD254: cfg_init (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x6218AE5: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x62189EF: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x6218D86: main_loop_reload_config_initiate (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x6218DE4: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x624EE53: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x624D200: ??? (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x624D8BF: iv_fd_poll_and_run (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x624E826: iv_main (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x62191A8: main_loop_run (in /usr/local/lib/libsyslog-ng-3.5.6.so)
==30140==    by 0x40187A: main (in /usr/local/sbin/syslog-ng)

Researching I found this defect and the note that it was 'reproducible' in 3.5.6.

So, has a patch or fix been released?

Pertaining to the question in the note, I am using unix-dgram().


Christopher Johnson
chris.johnson3 at hp.com<mailto:chris.johnson3 at hp.com>
HP Software - Security Product Group
(916) 785-2817

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/syslog-ng-maintainers/attachments/20150411/215d26ad/attachment.html>

More information about the Syslog-ng-maintainers mailing list