new argus on the dev server

[Terry Burton]

On Fri, Oct 8, 2010 at 10:28 PM, Carter Bullard <carter at qosient.com> wrote:
> So I've run this thing over and over and over, and I'm not getting appreciable memory leaking.
> I ran 2GB of packets through it, and only lost 1.7Kbytes of buffers, and they are in initialization
> blocks, so I can't replicate your report.
>
> Did you grab the absolutely most recent version of argus-3.0.3.17?  Grab it again, and re-run
> your tests, if you think you grabbed an earlier version of 17.
>
> I'm deploying on a number of machines now, so I'll let it cook for a few days and see if I can
> see any loss, but so far nada.

Hi Carter,

I've compared md5sums and I'm definitely running the most recent
version of Argus. I'm hoping to find time to have a proper look into
this issue tomorrow afternoon.

Whilst investigating I found a couple more nits that you might want to
look into before cutting a new release:

When using argus-udp:// output, after running for a while on a
moderately system sendto() may return EAGAIN which is followed by a
segfault:

Oct 11 15:07:48 oink argus[3457]: 11 Oct 10 15:07:48.827421
ArgusInitOutput: sendto(): retn -1 Resource temporarily unavailable
Oct 11 15:07:48 oink kernel: [1812219.298198] argus[3460]: segfault at
90 ip 7fa9211db628 sp 41f378b0 error 4 in
libpthread-2.7.so[7fa9211d4000+16000]

Running as a non-root user appears to be broken. When run as root
ArgusInitOutput sets both the uid and euid to "argus" so that there is
no way for ArgusInitSource to recover sufficient privilege to attach
to the pcap interface.

# argus -u argus -X -J -R -Z -U 80 -m -M 60 -i eth1/1.2.3.4
argus[15373]: 11 Oct 10 15:43:19.905257 started
argus[15373]: 11 Oct 10 15:43:19.909257 ArgusOpenInterface:
pcap_open_livmake socket: Operation not permitted
Segmentation fault


Thanks,

Terry


> On Oct 7, 2010, at 9:59 AM, Terry Burton wrote:
>> On Wed, Oct 6, 2010 at 6:50 PM,  <carter at qosient.com> wrote:
>>> 17 is attempting to deal with memory problems, so if we've got leaks, there is more work to do.
>>>
>>> Any chance you could run valgrind against argus on your system?
>>
>> Hi Cater,
>>
>> The output of a couple of successive valgrind runs is included below,
>> though I'm not sure that you will find them particularly illuminating
>> for this issue since they do not indicate much of a leak.
>>
>> I will continue to experiment as I find time.
>>
>>
>> Thanks,
>>
>> Terry