[Lognorm] Memory Leak in liblognorm?

[Rainer Gerhards]

Can you run it under valgrind and tell what it says at end of run?

Sent from phone, thus brief.
Am 12.07.2013 22:00 schrieb "Champ Clark III" <cclark at quadrantsec.com>:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> Hello All!
>
> I've got either a memory leak in liblognorm _or_ I'm not doing
> something correctly.   In Sagan,  we have "processors" that do log
> analysis using other techniques besides "rules".  As part of this
> process,  liblognorm is used pretty heavily.
>
> In the Sagan processor,  if I turn on liblognorm,  Sagan slowly starts
> to consume memory.  However,  if I tell the processor not to use
> liblognorm,  the memory stays consistent.
>
> My thoughts are that I'm not either clean up after using liblognorm
> correctly or liblognorm has a slow memory leak.
>
> My slightly mangled debug/Sagan code is at:
>
> https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c
>
> I think the problem is in the sagan_normalize_liblognorm() function.
> Near the end,  I've tried various ways to clean up, but with no
> affect.  (ee_deleteEvent(), free(), etc)
>
> Any ideas would be greatly appreciated.
>
>
> - --
> - - Champ Clark III (cclark at quadrantsec.com)
>   Quadrant Information Security (http://quadrantsec.com)
>   Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
>   GPG Key ID: 0381878A
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQEcBAEBAgAGBQJR4GBRAAoJENnmXt7Lmc3KpIIH/3RP5p/oW9BonTE9/7Pj5pro
> SdijQuYGQOox2yuWKwxAXGzES5jMu5ItqH+cdi7Oi3ddtPEVVEgvPVcGgYqiWhDP
> ic6APvPgG9nAPT/ouCwjDc1Wi4w6n/sAXJgAmqFjfjJA3Idxeqhr4XPcUyeDunc8
> MkR/Nbrozoo7n3pNoZSqR9mpd//ERF1nwcSUjmtBzuLSiQSR9FCl9JktykW6E2MR
> 76fZd6prxTkhMigFC9NHF5Hf1B5ByrTOt5W76zzP2bwTK1XI5NDya0GKGixZMhEx
> cCgApVAFA0eA0eL8uK+cIpKSd0tLNzsnH0GoR66mwhtqiQPoNkji5Og4+JrkowQ=
> =JDfT
> -----END PGP SIGNATURE-----
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20130712/6e3ed5ae/attachment.htm>