[Oisf-devel] Mem leaks

[Eric Leblond]

Hello,

On Thu, 2011-10-06 at 18:55 +0100, Chris Wakelin wrote:
> I've tried running the latest git master with PF_RING autofp (I didn't
> hit Martin's problem as I'd specified interface and cluster_id on the
> command line) on both machines (students and campus) and it seems pretty
> OK.
> 
> Memory on both reached 9.8GB and stayed there, and killing suricata on
> the students machine (after 40 minutes) didn't segfault, I think, though
> I had core dumping disabled.
> 
> I'm now trying "workers" with 6 threads. It seems broadly similar to
> Will's "single" mode. Is that correct? What is the difference between
> these and "single" in the git master?

None :) but "single" is mono thread and "workers" is a set of "single"
threads.

BR,

> 
> Best Wishes,
> Chris
> 
> 
> On 06/10/11 15:46, Chris Wakelin wrote:
> > I was wondering whether Anoop's ac fixes (b7b580) might be the issue,
> > but I'm not at all sure. It might be that my cores sizes are bigger
> > anyway because I switched from b2g to ac. Getting them every time I
> > killed suricata certainly brought their size to my attention :(
> > 
> > I'll try the latest git master for a bit! Might even try runmode=worker :)
> > 
> > Best Wishes,
> > Chris
> > 
> > On 06/10/11 15:32, Victor Julien wrote:
> >> On 10/06/2011 04:30 PM, Martin Holste wrote:
> >>> Yeah, maybe, but the baseline is almost double.  Do you want me to
> >>> switch back to master for awhile?
> >>
> >> If you can, please. The bigger baseline is certainly unintentional, so
> >> we'll look into that as well.
> >>
> >> Btw, I think Eric fixed the pfring shutdown thing as well in the updated
> >> master.
> >>
> >> Cheers,
> >> Victor
> >>
> >>> On Thu, Oct 6, 2011 at 9:25 AM, Victor Julien <victor at inliniac.net> wrote:
> >>>> So could it be that the master just has a higher baseline but stops
> >>>> growing at some point as well? The higher baseline might be explained by
> >>>> some AC pattern matcher updates.
> >>>>
> >>>> On 10/06/2011 02:59 AM, Martin Holste wrote:
> >>>>> bc5, still no leaks.
> >>>>>
> >>>>> On Wed, Oct 5, 2011 at 7:54 PM, Victor Julien <victor at inliniac.net> wrote:
> >>>>>> On 10/05/2011 11:41 PM, Martin Holste wrote:
> >>>>>>> Seems to be no leaks thus far after 4 hours.
> >>>>>>
> >>>>>> So what git ref is it you are running now exactly? Lost track.
> >>>>>>
> > 
> 
> 

-- 
Eric Leblond 
Blog: http://home.regit.org/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20111006/12b1e2b7/attachment.sig>