<p dir="ltr">Can you run it under valgrind and tell what it says at end of run?</p>
<p dir="ltr">Sent from phone, thus brief. </p>
<div class="gmail_quote">Am 12.07.2013 22:00 schrieb "Champ Clark III" <<a href="mailto:cclark@quadrantsec.com">cclark@quadrantsec.com</a>>:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
<br>
Hello All!<br>
<br>
I've got either a memory leak in liblognorm _or_ I'm not doing<br>
something correctly.   In Sagan,  we have "processors" that do log<br>
analysis using other techniques besides "rules".  As part of this<br>
process,  liblognorm is used pretty heavily.<br>
<br>
In the Sagan processor,  if I turn on liblognorm,  Sagan slowly starts<br>
to consume memory.  However,  if I tell the processor not to use<br>
liblognorm,  the memory stays consistent.<br>
<br>
My thoughts are that I'm not either clean up after using liblognorm<br>
correctly or liblognorm has a slow memory leak.<br>
<br>
My slightly mangled debug/Sagan code is at:<br>
<br>
<a href="https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c" target="_blank">https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c</a><br>
<br>
I think the problem is in the sagan_normalize_liblognorm() function.<br>
Near the end,  I've tried various ways to clean up, but with no<br>
affect.  (ee_deleteEvent(), free(), etc)<br>
<br>
Any ideas would be greatly appreciated.<br>
<br>
<br>
- --<br>
- - Champ Clark III (<a href="mailto:cclark@quadrantsec.com">cclark@quadrantsec.com</a>)<br>
  Quadrant Information Security (<a href="http://quadrantsec.com" target="_blank">http://quadrantsec.com</a>)<br>
  Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A<br>
  GPG Key ID: 0381878A<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)<br>
Comment: GPGTools - <a href="http://gpgtools.org" target="_blank">http://gpgtools.org</a><br>
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br>
<br>
iQEcBAEBAgAGBQJR4GBRAAoJENnmXt7Lmc3KpIIH/3RP5p/oW9BonTE9/7Pj5pro<br>
SdijQuYGQOox2yuWKwxAXGzES5jMu5ItqH+cdi7Oi3ddtPEVVEgvPVcGgYqiWhDP<br>
ic6APvPgG9nAPT/ouCwjDc1Wi4w6n/sAXJgAmqFjfjJA3Idxeqhr4XPcUyeDunc8<br>
MkR/Nbrozoo7n3pNoZSqR9mpd//ERF1nwcSUjmtBzuLSiQSR9FCl9JktykW6E2MR<br>
76fZd6prxTkhMigFC9NHF5Hf1B5ByrTOt5W76zzP2bwTK1XI5NDya0GKGixZMhEx<br>
cCgApVAFA0eA0eL8uK+cIpKSd0tLNzsnH0GoR66mwhtqiQPoNkji5Og4+JrkowQ=<br>
=JDfT<br>
-----END PGP SIGNATURE-----<br>
_______________________________________________<br>
Lognorm mailing list<br>
<a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
</blockquote></div>