[Bro-Dev] [JIRA] (BIT-1058) Memory leak in sumstats (probably)
Jon Siwek (JIRA)
jira at bro-tracker.atlassian.net
Mon Aug 19 14:27:38 PDT 2013
[ https://bro-tracker.atlassian.net/browse/BIT-1058?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13601#comment-13601 ]
Jon Siwek commented on BIT-1058:
--------------------------------
I was looking at this a bit last week, but haven't got back to it yet. My current guess is it's something to do with the Trigger/StateAccess/NotifierRegistry code. The sumstats scripts have a couple places where the condition of a {{when()}} block depends on {{done_with\[uid\]}} so places that do {{++done_with\[uid\]}} trigger creation of a new value that's reported as leaked possibly because that value is being held by the trigger-notification code or because Bro terminates before that trigger-notification code has a chance to run and release resources.
> Memory leak in sumstats (probably)
> ----------------------------------
>
> Key: BIT-1058
> URL: https://bro-tracker.atlassian.net/browse/BIT-1058
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Affects Versions: 2.2
> Reporter: Bernhard Amann
> Priority: High
> Labels: leak, sumstats
> Fix For: 2.2
>
> Attachments: out2.pdf
>
>
> At the moment, the core/leaks/basic-cluster.bro always fails; the gprof output is attached. Only the master node leaks memory, the two worker nodes are fine.
> From the gprof output, it looks like an increment operation is somehow triggering a memory leak.
> Robin and me tried to dig through this for quite some time. From our current understanding it looks like the memory leak is (indirectly) caused by an increment operation in a function that is called by an event that is received through remoteserialization.
> The closest we were able to track the leak to is line 249 of scripts/base/frameworks/sumstats/cluster.bro:
> {noformat}
> event SumStats::cluster_send_result(uid: string, ss_name: string, key: Key, result: Result, cleanup: bool)
> {
> [...]
> ++done_with[uid];
> }
> {noformat}
> Commenting out this line "fixes" the memory leak (and probably renders the sumstat framework inoperable); however we were not able to track it further to the exact cause; replacing the increment with an equivalent done_with[uid] = done_with[uid]+1; did not solve the problem.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://bro-tracker.atlassian.net/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the bro-dev
mailing list