<div dir="ltr">ah, now it is easy to see (for me ;)). Look at line 125+. You do repeatedly:<br><br><pre> <span class="">propName</span> <span class="">=</span> <span class="">es_newStrFromBuf</span><span class="">(</span><span class="">...</span><span class=""></span><span class="">);<br>
<br></span></pre><pre><span class="">but you never delete propName before you assign a new value to it ;)<br><br>There may be other problems, I had just focussed on the first valgrind report. Let me know if this get's you going.<br>
<br>Rainer<br></span></pre><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sun, Jul 14, 2013 at 2:48 PM, Rainer Gerhards <span dir="ltr"><<a href="mailto:rgerhards@hq.adiscon.com" target="_blank">rgerhards@hq.adiscon.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote"><div class="im">On Sun, Jul 14, 2013 at 1:38 AM, Champ Clark III <span dir="ltr"><<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
<br>
</div>I was with my family going to the beach when I blasted out that<br>
valgrind output. That's what I meant by not getting a change to look.<br>
<br></blockquote><div><br></div></div><div>No problem at all, I guess we have similiar constraints.<br> <br></div><div class="im"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
I've had a short time to look now, but man... I'm not seeing it...<br>
Later tonight I'm going to clean this up a little bit and see if it<br>
become more clear.<br>
<br></blockquote><div><br></div></div><div>Well, it may take a short while to get used to reading the output. Take this here for example:<br><br>==8756== 835,776 bytes in 52,236 blocks are definitely lost in loss record 56 of 60<br>
so we lot 52,236 "object", alltogehter 835,776 bytes; now comes the stacktrace where they were allocated<br><br>==8756== at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)<br>==8756== by 0x5457CD9: es_newStr (string.c:105)<br>
so its about estr<br><br>==8756== by 0x5457D5E: es_newStrFromBuf (string.c:139)<br>==8756== by 0x40C35C: sagan_normalize_liblognorm (sagan-liblognorm.c:131)<br>This is where your code called it (sagan-liblognorm.c, line 131)<br>
<br>==8756== by 0x41464F: Sagan_Blacklist (sagan-blacklist.c:167)<br>==8756== by 0x40BD37: Sagan_Processor (sagan-processor.c:123)<br>==8756== by 0x595EE99: start_thread (pthread_create.c:308<br><br> <br></div><div class="im">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
I do use es_deleteStr() to clean that up, correct? Because I don't<br>
see where I'm not.<br>
<br></blockquote><div><br></div></div><div>yup - you should now check the code what happens to that object that was allocated in line 131.<br> <br></div><div class="im"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
I appreciate the time Rainer. I'll look a bit more later and see if I<br>
can't locate it.<br>
<div><br></div></blockquote><div><br></div></div><div>side-note: there are many off-by-one errors mentioned in the valgrind log. I highly suggest to work through them, as they may lead to "interesting" effects. rsyslog stability greatly improved when I made sure there are no valgrind exception and I highly recommend doing that.<span class="HOEnZb"><font color="#888888"><br>
<br>Rainer <br></font></span></div><div><div class="h5"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
<br>
<br>
On 7/13/13 5:35 PM, Rainer Gerhards wrote:<br>
> Das<br>
><br>
> Sent from phone, thus brief. Am 13.07.2013 23:33 schrieb "Champ<br>
> Clark III" <<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a><br>
</div>> <mailto:<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>>>:<br>
<div>>><br>
>> Just fyi... I havent even looked at the yet myself.<br>
><br>
> You should ; ) it tells you precisely where the leak is. Its at<br>
> least one estr that's not destructed. I can't get more in depth on<br>
> the phone. Just look at the stack trace :)<br>
><br>
> I have another run going with no error limit btw.<br>
>><br>
>> Champ Clark III <<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a><br>
</div><div>> <mailto:<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>>> wrote:<br>
>>><br>
> Okay - this is from a short (45 minute) run..<br>
><br>
> I'll send another in a bit...<br>
><br>
> tell me if it sheds any light.<br>
><br>
><br>
> On 7/13/13 2:13 PM, Rainer Gerhards wrote:<br>
>>>>><br>
>>>>> Sounds good. I am interested in the memleak stats that are<br>
>>>>> printed out at termination.<br>
>>>>><br>
>>>>> Sent from phone, thus brief.<br>
>>>>><br>
>>>>> Am 13.07.2013 19:12 schrieb "Champ Clark III"<br>
>>>>> <<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a> <mailto:<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>><br>
</div>>> <mailto:<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a><br>
<div>>> <mailto:<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>>>>:<br>
>>>>><br>
>>>>> Hello Rainer,<br>
>>>>><br>
>>>>> I got my Ubuntu test env up and configured. I'm letting it<br>
>>>>> run for a good bit, because it seems the leak doesn't<br>
>>>>> always immediately show up. I'm running valgrind with the<br>
>>>>> following options:<br>
>>>>><br>
>>>>> valgrind --tool=memcheck --leak-check=yes<br>
>>>>><br>
>>>>> and<br>
>>>>><br>
>>>>> valgrind --tool=memcheck --leak-check=full<br>
>>>>> --show-reachable=yes --error-limit=no<br>
>>>>><br>
>>>>> Any other flags you want/need?<br>
>>>>><br>
>>>>><br>
>>>>> ________________________________ Lognorm mailing list<br>
>>>>> <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
>>>>> <mailto:<a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a>><br>
</div>>> <mailto:<a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
<div>>> <mailto:<a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a>>><br>
>>>>> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
>>>>><br>
>>>>><br>
>>>>><br>
>>>>> ________________________________ Lognorm mailing list<br>
>>>>> <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
>>>>> <mailto:<a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a>><br>
>>>>> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
><br>
><br>
><br>
>>><br>
>>> ________________________________<br>
>>><br>
>>> Lognorm mailing list <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
</div>>>> <mailto:<a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a>><br>
<div>>>> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
>><br>
>><br>
>> -- Quadrant Information Security Champ Clark III o: 904.296.9100<br>
>> x 101 c: 850.443.2440<br>
>><br>
>> _______________________________________________ Lognorm mailing<br>
>> list <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
</div>>> <mailto:<a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a>><br>
>> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
<div>>><br>
><br>
><br>
><br>
> _______________________________________________ Lognorm mailing<br>
> list <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
><br>
<br>
</div><div>- --<br>
- - Champ Clark III (<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>)<br>
Quadrant Information Security (<a href="http://quadrantsec.com" target="_blank">http://quadrantsec.com</a>)<br>
Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A<br>
GPG Key ID: 0381878A<br>
-----BEGIN PGP SIGNATURE-----<br>
</div>Version: GnuPG/MacGPG2 v2.0.17 (Darwin)<br>
<div>Comment: GPGTools - <a href="http://gpgtools.org" target="_blank">http://gpgtools.org</a><br>
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br>
<br>
</div>iQEcBAEBAgAGBQJR4eUIAAoJENnmXt7Lmc3KEvUH/3GySdbJ0tvz4fEdK7lizUCS<br>
eyC20YUaPYMvdt7vJe5unpRAGzrczi1GyDgWMoxgKhjX71xuQnqEi8KWXxcx3Boj<br>
Cz8xjmPJUv0IcQWvzqVxw3H2qA0BNwGnyTD6OY5BIRE9RYR0N58iniULdEAU0zQT<br>
T2hhBq30/xKCWhQ54CDmmBpg4gwVHAfJtskNGa43H119jEOt0gisJ8IUT6QkkKQR<br>
jdl5CLgUaIoGW76oN8I86j4toditngHuviDD9nM8MIh0S+s5bFnCAM5lWlQYfo7t<br>
70nSlAD1/bvdCfOfe1OwNMuoTDWFQOSbAHjITo2NuTJT8ggzVpqTf32z/oqTZKA=<br>
=+VQJ<br>
-----END PGP SIGNATURE-----<br>
<div><div>_______________________________________________<br>
Lognorm mailing list<br>
<a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
</div></div></blockquote></div></div></div><br></div></div>
</blockquote></div><br></div>