[Oisf-devel] suricata memory consumption not follow down after http test stoped.

Delta Yeh delta.yeh at gmail.com
Tue Sep 13 08:39:37 EDT 2011


Hi,
  I update suricata source to git HEAD.
  I  build suricata in a Debian lenny virtual machine( 1GRAM , two
core 2.1G CPU) with
    1. autogen.sh
     2. ./configure
     3. make && make install

 The suricata.yaml is the default .
I use ./suricata -c /etc/suricata/suricata.yaml -i eth0  to start suricata.

I run apache ab( ab -c 1 -n 60000   http://192.168.1.123/) to test
suricata(a simple nginx welcome page).
During the test, I can see the memory suricata consumed grown up.
When 60000 request finished, in the top output,the suricata process
mem is 45.2%.
5 minutes later, the mem is STILL 45.2%, only CPU change from 45% to 4%.

I then start another 60000 http request test with ab, the memory
suricata consumed INCREASED!!

It this a memory leakage?


----------------------------------------------------------

debian:~/suricata/oisf# uname -a
Linux debian 2.6.26-2-686 #1 SMP Wed May 12 21:56:10 UTC 2010 i686 GNU/Linux
debian:~/suricata/oisf# src/.libs/suricata  --build-info
[26298] 13/9/2011 -- 20:38:10 - (suricata.c:633) <Info> (main) -- This
is Suricata version 1.1beta2 (rev e131814)
[26298] 13/9/2011 -- 20:38:10 - (suricata.c:516) <Info>
(SCPrintBuildInfo) -- Features: LIBPCAP_VERSION_MAJOR=0 LIBCAP_NG
LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK
[26298] 13/9/2011 -- 20:38:10 - (suricata.c:530) <Info>
(SCPrintBuildInfo) -- 32-bits, Little-endian architecture
[26298] 13/9/2011 -- 20:38:10 - (suricata.c:532) <Info>
(SCPrintBuildInfo) -- GCC version 4.3.2, C version 199901
[26298] 13/9/2011 -- 20:38:10 - (suricata.c:538) <Info>
(SCPrintBuildInfo) -- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_1
[26298] 13/9/2011 -- 20:38:10 - (suricata.c:541) <Info>
(SCPrintBuildInfo) -- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_2
[26298] 13/9/2011 -- 20:38:10 - (suricata.c:544) <Info>
(SCPrintBuildInfo) -- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_4
[26298] 13/9/2011 -- 20:38:10 - (suricata.c:547) <Info>
(SCPrintBuildInfo) -- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_8

top output:
PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
26081 root      20   0 1129m 540m 1860 S 47.2 53.2   5:27.69 suricata
26284 root      20   0 12832 3208 2164 R  8.6  0.3   0:13.54 ab

BR,
  DeltaY


More information about the Oisf-devel mailing list