<p dir="ltr">Use es_deleteStr instead of es_emptyStr. The latter just resets it but does not free.  More explanations follow tomorrow.  Please report back.</p>
<p dir="ltr">Sent from phone, thus brief. </p>
<div class="gmail_quote">Am 15.07.2013 21:06 schrieb "Champ Clark III" <<a href="mailto:cclark@quadrantsec.com">cclark@quadrantsec.com</a>>:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
<br>
Hello,<br>
<br>
So - I've stripped down the code a good bit to see if I can't isolate<br>
where I'm going wrong.  Below is what I got:<br>
<br>
- --<snip>--<br>
str = es_newStrFromCStr(syslog_msg, strlen(syslog_msg));<br>
ln_normalize(ctx, str, &lnevent);<br>
<br>
       if(lnevent != NULL) {<br>
                es_emptyStr(str);<br>
                ee_fmtEventToRFC5424(lnevent, &str);<br>
                }<br>
<br>
free(cstr);<br>
es_deleteStr(str);<br>
ee_deleteEvent(lnevent);<br>
}<br>
- --<snip>--<br>
<br>
It appears as soon as I add the "ee_fmtEventToRFC5424",  valgrind starts<br>
to report the following:<br>
<br>
==21979== 69,872 bytes in 614 blocks are definitely lost in loss record<br>
52 of 54<br>
==21979==    at 0x4C2B6CD: malloc (in<br>
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)<br>
==21979==    by 0x5457CD9: es_newStr (string.c:105)<br>
==21979==    by 0x5457D0E: es_newStrFromCStr (string.c:125)<br>
==21979==    by 0x40C167: sagan_normalize_liblognorm<br>
(sagan-liblognorm.c:103)<br>
==21979==    by 0x41427F: Sagan_Blacklist (sagan-blacklist.c:167)<br>
==21979==    by 0x40BC07: Sagan_Processor (sagan-processor.c:123)<br>
==21979==    by 0x595EE99: start_thread (pthread_create.c:308)<br>
<br>
If I remove the line,  that goes away.    Any thoughts?<br>
<br>
Thanks for your time.<br>
<br>
- --<br>
- - Quadrant Information Security<br>
  Champ Clark III<br>
  o: 800.538.9357 x 101<br>
  c: 850.443.2440<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.11 (GNU/Linux)<br>
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" target="_blank">http://www.enigmail.net/</a><br>
<br>
iQEcBAEBAgAGBQJR5EgaAAoJENnmXt7Lmc3K6qMH/2ohomzUEQr+yi6pwNRUbM6P<br>
P3LfzxqccDSsJkDyY5EYY611S8ohHP0ZRdFyzQmRger1KXfSgvEGbs+brZC8rKYb<br>
OINB89GzG7A/Wu3SHnDwNSeLC2OKT+e14FslgBH0PqPgLy7PWnUmXbLxVAs58DXH<br>
3XydPkLumZC2K/vQwYFfxMxGTM90+cE8QRUXdaQ5ihndUg/9zI5BPeOvrOOffR69<br>
ZscCxZhob/qWMlCuOZd37iAayMROnzg8dWFq1SoWiITFn+PazhyXVsXvbA823VYJ<br>
vztu09FeH3LkcKt0XNgY8a+ITBmSTZ65ioMnJ4sXRjk2Sh1M94fWl8NV2sDX1qk=<br>
=oOrC<br>
-----END PGP SIGNATURE-----<br>
<br>
_______________________________________________<br>
Lognorm mailing list<br>
<a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
</blockquote></div>