Memory Leak in Audisp-Plugin

Memory Leak in Audisp-Plugin

[Shashank Akula]

[-- Attachment #1.1: Type: text/plain, Size: 299 bytes --]

Hi,

I have an issue regarding Audisp-Plugin which is leaking memory since
migration to py3 from py2. I also observed that Auparse module's behavior
is different in py3 and py2, I don't know if this is the actual reason for
leak.

Can you please help me to get this fixed?



Regards
Shashank Akula

[-- Attachment #1.2: Type: text/html, Size: 567 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: Memory Leak in Audisp-Plugin

[Steve Grubb]

Hello,

On Monday, July 19, 2021 6:57:58 PM EDT Shashank Akula wrote:
> I have an issue regarding Audisp-Plugin which is leaking memory since
> migration to py3 from py2.

What version of audit?

> I also observed that Auparse module's behavior is different in py3 and py2,

It should be very close. But python 3 is slightly different. Internal data 
structures changed. We had a similar problem caused by python 3.8 which 
modified/obsoleted internal datastructures.

> I don't know if this is the actual reason for leak.

Might be good to know the version and if you have any valgrind output that 
shows where the leak might be.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

Re: Memory Leak in Audisp-Plugin

[Steve Grubb]

Hello,

Adding linux-audit back to the reply.

On Monday, July 19, 2021 7:45:02 PM EDT you wrote:
> Audit version is 2.3.2(It's old I know, but can't change that),

This is so old that its virtually unsupported. It was released 8 years ago.

> and I don't have any valgrind output, I left the auditd service status on
> and saw memory utilisation after few days and Audisp-Plugin (.py file) was
> consuming alot of memory.
>
> I didn't try valgrind, would that be helpful in identifying the problem?

Yes, that is the standard goto tool for memory leaks. Although, its harder to 
diagnose when python is involved.
 
> And also can you share any patches on this in audit files or py files or in
> code related to audisp/auparse folders(in repo).

This is the history of the python bindings:
https://github.com/linux-audit/audit-userspace/commits/master/bindings/
python/auparse_python.c

> As the next versions of audit doesn't have this issue, 

You mean 2.3.3?

> I'm sure that you can find some patch which deals with this issue.

Take a look through the history. One of them does it. I think one might even 
mention memory leak.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit