linux-audit.redhat.com archive mirror
 help / color / mirror / Atom feed
From: Steve Grubb <sgrubb@redhat.com>
To: Shashank Akula <shashank.akula18@gmail.com>
Cc: linux-audit@redhat.com
Subject: Re: Memory Leak in Audisp-Plugin
Date: Mon, 19 Jul 2021 21:37:04 -0400	[thread overview]
Message-ID: <5730854.lOV4Wx5bFT@x2> (raw)
In-Reply-To: <CAME_CjZzP1MzFdd64o5KMnnS9ZomAPKnOROm5C0C03o1EE+6sw@mail.gmail.com>

Hello,

Adding linux-audit back to the reply.

On Monday, July 19, 2021 7:45:02 PM EDT you wrote:
> Audit version is 2.3.2(It's old I know, but can't change that),

This is so old that its virtually unsupported. It was released 8 years ago.

> and I don't have any valgrind output, I left the auditd service status on
> and saw memory utilisation after few days and Audisp-Plugin (.py file) was
> consuming alot of memory.
>
> I didn't try valgrind, would that be helpful in identifying the problem?

Yes, that is the standard goto tool for memory leaks. Although, its harder to 
diagnose when python is involved.
 
> And also can you share any patches on this in audit files or py files or in
> code related to audisp/auparse folders(in repo).

This is the history of the python bindings:
https://github.com/linux-audit/audit-userspace/commits/master/bindings/
python/auparse_python.c

> As the next versions of audit doesn't have this issue, 

You mean 2.3.3?

> I'm sure that you can find some patch which deals with this issue.

Take a look through the history. One of them does it. I think one might even 
mention memory leak.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit


      parent reply	other threads:[~2021-07-20  1:38 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-19 22:57 Memory Leak in Audisp-Plugin Shashank Akula
2021-07-19 23:30 ` Steve Grubb
     [not found]   ` <CAME_CjZzP1MzFdd64o5KMnnS9ZomAPKnOROm5C0C03o1EE+6sw@mail.gmail.com>
2021-07-20  1:37     ` Steve Grubb [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5730854.lOV4Wx5bFT@x2 \
    --to=sgrubb@redhat.com \
    --cc=linux-audit@redhat.com \
    --cc=shashank.akula18@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).