[Oisf-users] USR2 causes increased memory usage causing fast.log to stop appending

[Zeolla@GMail.com]

Hi all,

I recently upgraded my boxes to 3.0.1, and I seem to be having stability
issues when I send a USR2 after each day's signature update.  Memory
consumption seems to skyrocket after the USR2 (similar to when first
starting the server), however my boxes are currently running with very
little room to spare.  Due to the comments in this issue
<https://redmine.openinfosecfoundation.org/issues/1659>, I'm not clear if
it is currently required to duplicate in-memory rules after receiving a
USR2 to do the update (and this would be a feature request), or if this is
a true issue.

My fast.log stops getting written to, but the service and PID stay alive,
making it somewhat difficult to monitor for and automatically fix with
something like a puppet service ensure => running.  In addition, if I don't
do a service restart or USR2 for more than a day, I see the same issue
where fast.log stops appending but the service/pid stays up.

I have been able to verify that if I send a USR2 not long after a service
restart (when there is plenty of RAM to spare), it will successfully
complete the rule load and fast.log will continue to work.  If I then send
a second or third USR2, memory usage does not change significantly.

In addition, the issue I mentioned earlier was resolved with comments that
I don't fully understand.  Was the core issue supposed to be fixed, or just
the memory leaks?

Any other suggestions?  I will be looking into compiling a debugging
version of my package with LeakSanitizer in the near future (probably
tomorrow).

Thanks,

Jon
-- 

Jon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160413/1e127734/attachment.html>