<html><head/><body><html><head></head><body>I understand about valgrind.. from my laet email is below... ill have you that log asap.<br>
<br>
<br>
"I got my Ubuntu 12.04 box back up with the dev tools and valgrind last<br>
night, but haven't had a chance to move over Sagan and test yet. I<br>
hope to be able to do that today."<br><br><div class="gmail_quote">Rainer Gerhards <rgerhards@hq.adiscon.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr">any chance to get a valgrind log? That would be immensely helpful, as it usually points out where memory was allocted...<br /></div><div class="gmail_extra"><br /><br /><div class="gmail_quote">On Sat, Jul 13, 2013 at 1:39 PM, Champ Clark III <span dir="ltr"><<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>></span> wrote:<br />
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">-----BEGIN PGP SIGNED MESSAGE-----<br />
Hash: SHA1<br />
<br />
</div>Thank you John,<br />
<br />
I've added a es_deleteStr(str) and freed just about all I can think of<br />
and I'm seeing the same results. Just to be on the safe side, I ran<br />
two versions of Sagan last night. One using liblognorm and the other<br />
without. I let these run for about 8 hours.<br />
<br />
In the end, the one without liblognorm used about 2.5 meg of RAM.<br />
The one with liblognorm eventually crept up to 128 meg of RAM (and<br />
still climbing).<br />
<br />
Like last time, I pushed the code up to github<br />
(<a href="https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c" target="_blank">https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c</a>).<br />
You where right about the es_deleteStr, but it's still slowly<br />
leaking. Essentially, this is what I did:<br />
<br />
free(cstr);<br />
free(field);<br />
es_deleteStr(str);<br />
es_deleteStr(propName); /* Just to be safe? */<br />
ee_deleteEvent(lnevent);<br />
<br />
<br />
I should add that I'm using the liblognorm (and other require libs)<br />
from Rainer's git repo.<br />
<br />
I got my Ubuntu 12.04 box back up with the dev tools and valgrind last<br />
night, but haven't had a chance to move over Sagan and test yet. I<br />
hope to be able to do that today.<br />
<br />
I feel that I'm not handling something correctly, so if you spot it<br />
let me know! I really appreciate it.<br />
<div class="im"><br />
<br />
<br />
<br />
<br />
On 7/12/13 4:27 PM, John Hopper wrote:<br />
> Heya!<br />
><br />
> I noticed in your code that you're calling the estr and ee library<br />
> to create events and strings but I don't see any calls to the<br />
> delete functions for either.<br />
><br />
> As far as I know, every time you create a new estr, it copies the<br />
> content into a new buffer which will need to be freed. The same<br />
> applies for the events created - these will also need to be freed.<br />
><br />
> -John<br />
><br />
<br />
</div><div class="im">- --<br />
- - Champ Clark III (<a href="mailto:cclark@quadrantsec.com">cclark@quadrantsec.com</a>)<br />
Quadrant Information Security (<a href="http://quadrantsec.com" target="_blank">http://quadrantsec.com</a>)<br />
Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A<br />
GPG Key ID: 0381878A<br />
-----BEGIN PGP SIGNATURE-----<br />
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)<br />
Comment: GPGTools - <a href="http://gpgtools.org" target="_blank">http://gpgtools.org</a><br />
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br />
<br />
</div>iQEcBAEBAgAGBQJR4TxUAAoJENnmXt7Lmc3KnuEH/0JzCAiG9oMdtzp7KMejAkJh<br />
FbtJBVCq+vIHSs9LMmJPTgRkekZBG+DhobMp9sHDvr01Hh8fAFbKvuQAS0Qu5T8t<br />
ukxfoF2Ia0C9VPJttiZrMEtKpkAk9vRNpYGad9DdJWrrfh4VcX9zwXp2x32CBJlC<br />
ehXyjE4UqN8SfHtBY1XP1WR3YqitplN9HjR7FW48rxHcraNleFtn442mH/2cXJZ1<br />
+IllY7MoJf/VdoXWKCZzQhEQjdNek4bTxt0K9cdDg/TwD4yucm9XMO+lw1pSluBX<br />
4Vkh1XCFlQsgWsG5Vf5pQPJdTx0qfOj3mRspz2v/UocnM0iv9aAA5iNEkn5Ouu4=<br />
=qMCp<br />
-----END PGP SIGNATURE-----<br />
<div class="HOEnZb"><div class="h5">_______________________________________________<br />
Lognorm mailing list<br />
<a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br />
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br />
</div></div></blockquote></div><br /></div>
<p style="margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000"></p><pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px"><hr /><br />Lognorm mailing list<br />Lognorm@lists.adiscon.com<br /><a href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br /></pre></blockquote></div><br>
-- <br>
Quadrant Information Security<br>
Champ Clark III<br>
o: 904.296.9100 x 101<br>
c: 850.443.2440</body></html></body></html>