[Lognorm] Memory Leak in liblognorm?

[Rainer Gerhards]

Will do tomorrow

Sent from phone, thus brief.
Am 12.07.2013 22:05 schrieb "Champ Clark III" <cclark at quadrantsec.com>:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I'll have to run on a different box,  as this machine (for whatever
> reason) doesn't play well with valgrind.  I'll do that from a Ubuntu
> VM ASAP.
>
> If you get a chance,  can you glance and the code and see if I'm
> blatantly and improperly cleaning up incorrectly?
>
> I'll let you know the results from valgrind ASAP.
>
>
> On 7/12/13 4:02 PM, Rainer Gerhards wrote:
> > Can you run it under valgrind and tell what it says at end of run?
> >
> > Sent from phone, thus brief.
> >
> > Am 12.07.2013 22:00 schrieb "Champ Clark III"
> > <cclark at quadrantsec.com <mailto:cclark at quadrantsec.com>>:
> >
> >
> > Hello All!
> >
> > I've got either a memory leak in liblognorm _or_ I'm not doing
> > something correctly.   In Sagan,  we have "processors" that do log
> > analysis using other techniques besides "rules".  As part of this
> > process,  liblognorm is used pretty heavily.
> >
> > In the Sagan processor,  if I turn on liblognorm,  Sagan slowly
> > starts to consume memory.  However,  if I tell the processor not to
> > use liblognorm,  the memory stays consistent.
> >
> > My thoughts are that I'm not either clean up after using
> > liblognorm correctly or liblognorm has a slow memory leak.
> >
> > My slightly mangled debug/Sagan code is at:
> >
> > https://github.com/beave/sagan/blob/master/src/sagan-liblognorm.c
> >
> > I think the problem is in the sagan_normalize_liblognorm()
> > function. Near the end,  I've tried various ways to clean up, but
> > with no affect.  (ee_deleteEvent(), free(), etc)
> >
> > Any ideas would be greatly appreciated.
> >
> >
> > _______________________________________________ Lognorm mailing
> > list Lognorm at lists.adiscon.com <mailto:Lognorm at lists.adiscon.com>
> > http://lists.adiscon.net/mailman/listinfo/lognorm
> >
> >
> >
> > _______________________________________________ Lognorm mailing
> > list Lognorm at lists.adiscon.com
> > http://lists.adiscon.net/mailman/listinfo/lognorm
> >
>
> - --
> - - Champ Clark III (cclark at quadrantsec.com)
>   Quadrant Information Security (http://quadrantsec.com)
>   Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
>   GPG Key ID: 0381878A
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQEcBAEBAgAGBQJR4GGHAAoJENnmXt7Lmc3K4oMH+wRHHkchFSsVgSx/CRZ33Ae3
> YAxqJNVKwNNkiS6wRKnMJp+odoV804VxxRzotSEFGHu3Tiz59p9cEPYf9SUK6hve
> zWONr3TdeCHkOaXZweeOZT5LK+Q+acehjIZp3314WFgm+NAfJ7Ms6fX/VC4qi/Yh
> MgFPlBjYjqYz4xAQRFvS3LtzU7U0mA+FXhT0LpchvfyDMKkSLmhJ+I3S+7qLExJo
> YnmI5Bt5laIVc4KAC8rzC/uKLuLRdaXbxrNUTqCZebLDdwJ040Llg267MdAZBiDR
> 5kQXXqH3a6tykebosydtZUxbp5OrXUVoVmOBZrGQYsQs4bb6P8YLKNtlRImADLA=
> =x/xI
> -----END PGP SIGNATURE-----
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20130712/be202165/attachment-0001.htm>