<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
Sorry, but same results :( I'm using the same test code below but
with es_emptyStr(str) replaced with es_deleteStr(str)<br>
<br>
<br>
<br>
On 07/15/2013 03:46 PM, Rainer Gerhards wrote:<br>
<span style="white-space: pre;">><br>
> Use es_deleteStr instead of es_emptyStr. The latter just
resets it but does not free. More explanations follow tomorrow.
Please report back.<br>
><br>
> Sent from phone, thus brief.<br>
><br>
> Am 15.07.2013 21:06 schrieb "Champ Clark III"
<<a class="moz-txt-link-abbreviated" href="mailto:cclark@quadrantsec.com">cclark@quadrantsec.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:cclark@quadrantsec.com"><mailto:cclark@quadrantsec.com></a>>:<br>
><br>
><br>
><br>
> Hello,<br>
><br>
> So - I've stripped down the code a good bit to see if I can't
isolate<br>
> where I'm going wrong. Below is what I got:<br>
><br>
> --<snip>--<br>
> str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg));<br>
> ln_normalize(ctx, str, &lnevent);<br>
><br>
> if(lnevent != NULL) {<br>
> es_emptyStr(str);<br>
> ee_fmtEventToRFC5424(lnevent, &str);<br>
> }<br>
><br>
> free(cstr);<br>
> es_deleteStr(str);<br>
> ee_deleteEvent(lnevent);<br>
> }<br>
> --<snip>--<br>
><br>
> It appears as soon as I add the "ee_fmtEventToRFC5424",
valgrind starts<br>
> to report the following:<br>
><br>
> ==21979== 69,872 bytes in 614 blocks are definitely lost in
loss record<br>
> 52 of 54<br>
> ==21979== at 0x4C2B6CD: malloc (in<br>
> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)<br>
> ==21979== by 0x5457CD9: es_newStr (string.c:105)<br>
> ==21979== by 0x5457D0E: es_newStrFromCStr (string.c:125)<br>
> ==21979== by 0x40C167: sagan_normalize_liblognorm<br>
> (sagan-liblognorm.c:103)<br>
> ==21979== by 0x41427F: Sagan_Blacklist
(sagan-blacklist.c:167)<br>
> ==21979== by 0x40BC07: Sagan_Processor
(sagan-processor.c:123)<br>
> ==21979== by 0x595EE99: start_thread
(pthread_create.c:308)<br>
><br>
> If I remove the line, that goes away. Any thoughts?<br>
><br>
> Thanks for your time.<br>
><br>
><br>
> _______________________________________________<br>
> Lognorm mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a><br>
> <a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Lognorm mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a></span><br>
<br>
- -- <br>
- - Quadrant Information Security<br>
Champ Clark III<br>
o: 800.538.9357 x 101<br>
c: 850.443.2440<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.11 (GNU/Linux)<br>
Comment: Using GnuPG with Thunderbird - <a class="moz-txt-link-freetext" href="http://www.enigmail.net/">http://www.enigmail.net/</a><br>
<br>
iQEcBAEBAgAGBQJR5FVtAAoJENnmXt7Lmc3K6kQH/j1eiHNggCJMRys8vkiEeKme<br>
evsfBZpTzlw7iTJFsHv/d3vBJub9dcm80y8kgYvmYOrjSea+GIWYKP8a1Ij44b/x<br>
fwd6QQYzRQ0VZljCFTbW+1xAczzaqTiaJyd4lljG3ecu7BFGG61FwWkr91DU+S1L<br>
DjhqAONjitYvJC4ZdHNoDfBuodBLTT0qr/BHtbYFDFCYfsIK8+7aSPw3PO6sFM/5<br>
rjGDXOcXYXZ8niPUorR0CdNekaqzUC5nwj3hUJBYWlw23FTzQfBuI+rIj2IfNl8Z<br>
6LIJXtfpbGt9z0eHOwnVRbytGKgOWheX2o27DGHSlcy41myIixgTZ6We2yNGk/s=<br>
=Ukse<br>
-----END PGP SIGNATURE-----<br>
<br>
</body>
</html>