Cflowd Memory leak. I think that this is the solution.

Date view Thread view Subject view Author view

Subject: Cflowd Memory leak. I think that this is the solution.
From: Albert Collet (albert.collet@telindus.es)
Date: Fri Feb 22 2002 - 03:17:54 CST 

Hello,

I have cflowd-2-1-b1 with the patch that writes raw files to process them
with flowscan.
I noticed that it has a memory leak. This memory leak increases the used
memory about 8K each time.
This effect can lead to:

Hang the machine or when the cflowd process has consumed lots of megs cflowd
cannot write the full raw-files resulting in less traffic being reported and
the overall system performance goes down.

I have been analyzing the source code for the cflowd patched version.
To correct it I have added these lines:

      // Solution to memory leak:
      for (ciscoMapIter = g_cflowdConfig.CiscoMap().begin();
           ciscoMapIter!= g_cflowdConfig.CiscoMap().end(); ciscoMapIter++) {
        ((*ciscoMapIter).second)->ClearTableData();
        ((*ciscoMapIter).second)->HaveRecentInterfaceInfo(false);
      }

after the current raw file has been closed and renamed with the timestamp.
If you have the patched version of cflowd.cc the line number is: 717.

I don't know if this can introduce some side-effects but it works fine for
me.
This piece of code it's the same that it's used to handle the collector
client after the process has forked (the parent process clear the tables
using this code).
You can see it at line: 373

If anyone knows this problem or has been dealt with it please let me know.
I know that some people solved it restarting the cflowd process periodically
but I think that it's not a good solution because you lose the current flow.

Albert.-



--
Help        mailto:majordomo@net.doit.wisc.edu and say "help" in message body
Unsubscribe mailto:majordomo@net.doit.wisc.edu and say
"unsubscribe flowscan" in message body
Archive     http://net.doit.wisc.edu/~plonka/list/flowscan/archive/

Date view Thread view Subject view Author view

This archive was generated by hypermail 2b25 : Fri Feb 22 2002 - 03:30:24 CST