{"action":"closed","issue":{"url":"https://api.github.com/repos/balabit/syslog-ng/issues/446","labels_url":"https://api.github.com/repos/balabit/syslog-ng/issues/446/labels{/name}","comments_url":"https://api.github.com/repos/balabit/syslog-ng/issues/446/comments","events_url":"https://api.github.com/repos/balabit/syslog-ng/issues/446/events","html_url":"https://github.com/balabit/syslog-ng/issues/446","id":65560703,"number":446,"title":"3.6.2 consumes all available memory over a few hours","user":{"login":"elentar","id":1018128,"avatar_url":"https://avatars.githubusercontent.com/u/1018128?v=3","gravatar_id":"","url":"https://api.github.com/users/elentar","html_url":"https://github.com/elentar","followers_url":"https://api.github.com/users/elentar/followers","following_url":"https://api.github.com/users/elentar/following{/other_user}","gists_url":"https://api.github.com/users/elentar/gists{/gist_id}","starred_url":"https://api.github.com/users/elentar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elentar/subscriptions","organizations_url":"https://api.github.com/users/elentar/orgs","repos_url":"https://api.github.com/users/elentar/repos","events_url":"https://api.github.com/users/elentar/events{/privacy}","received_events_url":"https://api.github.com/users/elentar/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/balabit/syslog-ng/milestones/9","html_url":"https://github.com/balabit/syslog-ng/milestones/syslog-ng%203.6.3","labels_url":"https://api.github.com/repos/balabit/syslog-ng/milestones/9/labels","id":1100322,"number":9,"title":"syslog-ng 3.6.3","description":"","creator":{"login":"ihrwein","id":1019384,"avatar_url":"https://avatars.githubusercontent.com/u/1019384?v=3","gravatar_id":"","url":"https://api.github.com/users/ihrwein","html_url":"https://github.com/ihrwein","followers_url":"https://api.github.com/users/ihrwein/followers","following_url":"https://api.github.com/users/ihrwein/following{/other_user}","gists_url":"https://api.github.com/users/ihrwein/gists{/gist_id}","starred_url":"https://api.github.com/users/ihrwein/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ihrwein/subscriptions","organizations_url":"https://api.github.com/users/ihrwein/orgs","repos_url":"https://api.github.com/users/ihrwein/repos","events_url":"https://api.github.com/users/ihrwein/events{/privacy}","received_events_url":"https://api.github.com/users/ihrwein/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":2,"state":"open","created_at":"2015-05-07T14:34:12Z","updated_at":"2015-06-08T13:40:53Z","due_on":"2015-06-11T22:00:00Z","closed_at":null},"comments":49,"created_at":"2015-03-31T22:28:53Z","updated_at":"2015-06-08T13:40:53Z","closed_at":"2015-06-08T13:40:53Z","body":"I have a number of servers running RHEL 6, using the RedHat-provided syslog-ng 3.2 to provide syslog archive functionality. I would like to take advantage of threading support, so I've been looking at upgrading to a newer build of syslog-ng. I happened upon syslog-ng 3.6.2 packages available here:\r\n\r\nhttps://copr-be.cloud.fedoraproject.org/results/czanik/syslog-ng36epel6/epel-6-x86_64/\r\n\r\nThese packages installed easily, requiring only the json-c and riemann-c-client packages as dependencies. I modified my running config to address the issues reported by the configcheck and started using 3.6.2.\r\n\r\nI've observed that over about 12 hours the process consumes all available memory on the server. If I split the traffic across multiple servers, the rate of memory consumption decreases accordingly, so it appears to be a function of the message volume.\r\n\r\nDuring the 12-hour incident, the message volume was approximately 4,500 messages per second. Around 48GB of memory was consumed during this test.\r\n\r\nDuring a 48-hour test, at a rate of 500 messages per second, 20GB of memory was consumed.\r\n\r\nI will attach a sanitized config file shortly."}}