[Lognorm] Memory Leak in liblognorm?

[Champ Clark III]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hello All!

I've got either a memory leak in liblognorm _or_ I'm not doing
something correctly.   In Sagan,  we have "processors" that do log
analysis using other techniques besides "rules".  As part of this
process,  liblognorm is used pretty heavily.

In the Sagan processor,  if I turn on liblognorm,  Sagan slowly starts
to consume memory.  However,  if I tell the processor not to use
liblognorm,  the memory stays consistent.

My thoughts are that I'm not either clean up after using liblognorm
correctly or liblognorm has a slow memory leak.

My slightly mangled debug/Sagan code is at:

https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c

I think the problem is in the sagan_normalize_liblognorm() function.
Near the end,  I've tried various ways to clean up, but with no
affect.  (ee_deleteEvent(), free(), etc)

Any ideas would be greatly appreciated.


- -- 
- - Champ Clark III (cclark at quadrantsec.com)
  Quadrant Information Security (http://quadrantsec.com)
  Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
  GPG Key ID: 0381878A
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJR4GBRAAoJENnmXt7Lmc3KpIIH/3RP5p/oW9BonTE9/7Pj5pro
SdijQuYGQOox2yuWKwxAXGzES5jMu5ItqH+cdi7Oi3ddtPEVVEgvPVcGgYqiWhDP
ic6APvPgG9nAPT/ouCwjDc1Wi4w6n/sAXJgAmqFjfjJA3Idxeqhr4XPcUyeDunc8
MkR/Nbrozoo7n3pNoZSqR9mpd//ERF1nwcSUjmtBzuLSiQSR9FCl9JktykW6E2MR
76fZd6prxTkhMigFC9NHF5Hf1B5ByrTOt5W76zzP2bwTK1XI5NDya0GKGixZMhEx
cCgApVAFA0eA0eL8uK+cIpKSd0tLNzsnH0GoR66mwhtqiQPoNkji5Og4+JrkowQ=
=JDfT
-----END PGP SIGNATURE-----