Argus memory issues

[Peter Van Epp]

On Mon, Aug 20, 2007 at 09:24:23AM -0400, Carter Bullard wrote:
> Gentle men,
> argus-3.0 is trying to do a lot more than argus-2.0 every tried to do,
> and the memory is the thing that is impacted the most.
> 
> So, two things, while I ponder what to do, does this option provide
> suitable memory use for your new probes:
> 
> ARGUS_FLOW_KEY="LAYER_3_MATRIX"
> 
> it won't be as light as argus-2.0 based on the current structure, but
> it lowers cpu and memory use.  If it is still eating memory, then
> a more aggressive timeout is indeed indicated.
> 
> Second, how is your cpu during this?  If we have some cycles,
> I have a strategy that will have more dynamic memory allocs, but
> runs a lot smaller because of the traffic mix.
> 
> I've been doing this argus-3.0 for too long now, without releasing
> something, so hopefully we can find an approach that will get this
> out the door and then I can fix it right later.
> 
> Carter
> 

	OK, I went back to a stock (no output task disable) no threads argus,
set ARGUS_FLOW_KEY="LAYER_3_MATRIX" and removed the -J and -R flags and
connected a single client and we will see how that goes (the 
ARGUS_FLOW_KEY="LAYER_3_MATRIX" certainly slowed down memory growth in a 
quick test). It may be that I just need more memory, but at 4 gigs now and
me a not all that large site, I expect that memory requirements may get out
of hand fast on a larger site. Also I had no indication that it wasn't a 
leak and would ever stop :-) but Russell seems to disprove that one so it 
may be only a matter of enough memory to survive (although I think a more
aggressive timeout would be better). My argus is using %4 CPU on my quad
core Power5 box so I think we have a lot of CPU to play with if that would
reduce memory usage. Memory use about 10 minutes in is 50K at the moment
so we are looking pretty good (would have been at least a couple of 100K
by this time on the old setup) although traffic is likely still quite low
here at this point.

ps auxwwww | grep argus
root     24977  4.3  1.2  55564 50824 ?        SLs  08:03   0:23 argus -d -P 560 -i eth0 -i eth1 -U 512 -m -F /scratch/argus.conf
root     24982  0.0  0.0   3132   832 pts/0    S+   08:12   0:00 grep argus
hcids:/scratch # ps auxwwww | grep argus
root     24977  4.3  1.2  55564 50824 ?        SLs  08:03   0:24 argus -d -P 560 -i eth0 -i eth1 -U 512 -m -F /scratch/argus.conf
root     24984  0.0  0.0   3132   832 pts/0    S+   08:12   0:00 grep argus

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada