Interesting things to look for in the current 3.0 code ...

[Carter Bullard]

Hey Peter,
Well my leaks are not real, at least on my Mac, or on the 64-bit  
intel machines,
but my traffic loads are not really high, so I could have a very slow  
memory issue.
I'll try to replicate this tomorrow on some other hardware that I  
have.  I did make
some significant changes just now, that could affect both the  
threaded and non
threaded versions.  I changed the way we assign timeout values to  
each flow.  It
was possible, although it appeared highly unlikely, that individual  
flows may
try to use idle timeouts in the 1000's of seconds (this maybe your  
old timestamp
issue, but no promises) or possibly 0, which could put them in a bin  
that
may never time out (except when a matching packet hits that cache  
then it
would come back into the system).  well anyway, I limited the range  
of timeout
values, and possibly that could have an effect.  I've just now uploaded
new argus and clients.

I'm going to let argus run all night on my mac running under  
mallocdebug, which
is not a bad program.  At least it showed me that I leaked 32 bytes,  
but thats it so
far ;o)

Carter

On Aug 16, 2007, at 9:33 PM, Peter Van Epp wrote:

> On Thu, Aug 16, 2007 at 04:43:59PM -0400, Carter Bullard wrote:
>> OK, I am now getting leaks here, so I'm on this (could be just the
>> user data buffers).
>> Carter
>>
>
> 	Looks like there is more than just the user stuff. I stopped  
> collecting
> the user data a few hours ago and the leak has slowed but doesn't  
> look to have
> stopped.
>
> root      3975  4.2 58.9 2332468 2319528 ?     SLsl 16:58   3:42  
> argus -dJR -P 560 -i eth0 -i eth1 -m -F /scratch/argus.conf
> vanepp    4141  0.0  0.0   3132   832 pts/1    S+   18:25   0:00  
> grep argus
> vanepp at hcids:/scratch> ps auxwwww | grep argus
> root      3975  4.2 59.1 2338636 2326352 ?     SLsl 16:58   3:43  
> argus -dJR -P 560 -i eth0 -i eth1 -m -F /scratch/argus.conf
> vanepp    4143  0.0  0.0   3132   832 pts/1    S+   18:25   0:00  
> grep argus
> vanepp at hcids:/scratch> ps auxwwww | grep argus
> root      3975  4.3 64.4 2547320 2535292 ?     SLsl 16:58   3:46  
> argus -dJR -P 560 -i eth0 -i eth1 -m -F /scratch/argus.conf
> vanepp    4145  0.0  0.0   3132   832 pts/1    S+   18:25   0:00  
> grep argus
> vanepp at hcids:/scratch> ps auxwwww | grep argus
> root      3975  4.3 66.5 2631728 2618792 ?     SLsl 16:58   3:56  
> argus -dJR -P 560 -i eth0 -i eth1 -m -F /scratch/argus.conf
>
> 	Perhaps I'll disable threads for a bit and see what happens.
>
> Peter Van Epp / Operations and Technical Support
> Simon Fraser University, Burnaby, B.C. Canada
>