<p dir="ltr">Ok thx.  Than i need to check the API  spec.  I have seen that the web doc is pretty old and missing functions - hopefully only the web...</p>
<p dir="ltr">Sent from phone, thus brief. </p>
<div class="gmail_quote">Am 15.07.2013 22:02 schrieb "Champ Clark III" <<a href="mailto:cclark@quadrantsec.com">cclark@quadrantsec.com</a>>:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

  
    
  
  <div text="#000000" bgcolor="#FFFFFF">
    <br>
    -----BEGIN PGP SIGNED MESSAGE-----<br>
    Hash: SHA1<br>
    <br>
    Sorry,  but same results :(   I'm using the same test code below but
    with es_emptyStr(str) replaced with es_deleteStr(str)<br>
    <br>
    <br>
    <br>
    On 07/15/2013 03:46 PM, Rainer Gerhards wrote:<br>
    <span style="white-space:pre-wrap">><br>
      > Use es_deleteStr instead of es_emptyStr. The latter just
      resets it but does not free.  More explanations follow tomorrow. 
      Please report back.<br>
      ><br>
      > Sent from phone, thus brief.<br>
      ><br>
      > Am 15.07.2013 21:06 schrieb "Champ Clark III"
      <<a href="mailto:cclark@quadrantsec.com" target="_blank">cclark@quadrantsec.com</a>
      <a href="mailto:cclark@quadrantsec.com" target="_blank"><mailto:cclark@quadrantsec.com></a>>:<br>
      ><br>
      ><br>
      ><br>
      > Hello,<br>
      ><br>
      > So - I've stripped down the code a good bit to see if I can't
      isolate<br>
      > where I'm going wrong.  Below is what I got:<br>
      ><br>
      > --<snip>--<br>
      > str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg));<br>
      > ln_normalize(ctx, str, &lnevent);<br>
      ><br>
      >        if(lnevent != NULL) {<br>
      >                 es_emptyStr(str);<br>
      >                 ee_fmtEventToRFC5424(lnevent, &str);<br>
      >                 }<br>
      ><br>
      > free(cstr);<br>
      > es_deleteStr(str);<br>
      > ee_deleteEvent(lnevent);<br>
      > }<br>
      > --<snip>--<br>
      ><br>
      > It appears as soon as I add the "ee_fmtEventToRFC5424", 
      valgrind starts<br>
      > to report the following:<br>
      ><br>
      > ==21979== 69,872 bytes in 614 blocks are definitely lost in
      loss record<br>
      > 52 of 54<br>
      > ==21979==    at 0x4C2B6CD: malloc (in<br>
      > /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)<br>
      > ==21979==    by 0x5457CD9: es_newStr (string.c:105)<br>
      > ==21979==    by 0x5457D0E: es_newStrFromCStr (string.c:125)<br>
      > ==21979==    by 0x40C167: sagan_normalize_liblognorm<br>
      > (sagan-liblognorm.c:103)<br>
      > ==21979==    by 0x41427F: Sagan_Blacklist
      (sagan-blacklist.c:167)<br>
      > ==21979==    by 0x40BC07: Sagan_Processor
      (sagan-processor.c:123)<br>
      > ==21979==    by 0x595EE99: start_thread
      (pthread_create.c:308)<br>
      ><br>
      > If I remove the line,  that goes away.    Any thoughts?<br>
      ><br>
      > Thanks for your time.<br>
      ><br>
      ><br>
      >     _______________________________________________<br>
      >     Lognorm mailing list<br>
      >     <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a>
      <a href="mailto:Lognorm@lists.adiscon.com" target="_blank"><mailto:Lognorm@lists.adiscon.com></a><br>
      >     <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
      ><br>
      ><br>
      ><br>
      > _______________________________________________<br>
      > Lognorm mailing list<br>
      > <a href="mailto:Lognorm@lists.adiscon.com" target="_blank">Lognorm@lists.adiscon.com</a><br>
      > <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a></span><br>
    <br>
    - -- <br>
    - - Quadrant Information Security<br>
      Champ Clark III<br>
      o: 800.538.9357 x 101<br>
      c: 850.443.2440<br>
    -----BEGIN PGP SIGNATURE-----<br>
    Version: GnuPG v1.4.11 (GNU/Linux)<br>
    Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br>
    <br>
    iQEcBAEBAgAGBQJR5FVtAAoJENnmXt7Lmc3K6kQH/j1eiHNggCJMRys8vkiEeKme<br>
    evsfBZpTzlw7iTJFsHv/d3vBJub9dcm80y8kgYvmYOrjSea+GIWYKP8a1Ij44b/x<br>
    fwd6QQYzRQ0VZljCFTbW+1xAczzaqTiaJyd4lljG3ecu7BFGG61FwWkr91DU+S1L<br>
    DjhqAONjitYvJC4ZdHNoDfBuodBLTT0qr/BHtbYFDFCYfsIK8+7aSPw3PO6sFM/5<br>
    rjGDXOcXYXZ8niPUorR0CdNekaqzUC5nwj3hUJBYWlw23FTzQfBuI+rIj2IfNl8Z<br>
    6LIJXtfpbGt9z0eHOwnVRbytGKgOWheX2o27DGHSlcy41myIixgTZ6We2yNGk/s=<br>
    =Ukse<br>
    -----END PGP SIGNATURE-----<br>
    <br>
  </div>

<br>_______________________________________________<br>
Lognorm mailing list<br>
<a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
<br></blockquote></div>