From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Odd memory usage in auditd Date: Mon, 11 Oct 2010 12:47:56 -0400 Message-ID: <201010111247.56584.sgrubb@redhat.com> References: <201010071551.23311.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, October 11, 2010 11:50:53 am Ross Kirk wrote: > > I seem to recall something about disk flushing causing auditd to look > > like its the culprit. Do you have barriers enabled on ext3? You might also > > try setting the flushing to something else like none and see if that does > > anything. > > Currently barriers are not enabled as it wasn't something I was aware of. > However it does sound like something I may well want to be enabled so I > will give the various flush settings a try and see if the barrier option > affects anything. Well, I was thinking that if you had it enabled that perhaps things were getting backed up. > So if auditd is not the culprit what do you suspect the > problem is? Yes. I think under some situations because the flushing is delayed, the kernel memory accounting associates the buffers not yet flushed to disk with the process that originates the request. I don't think that is fair, but seems to happen. > > Try playing with the disk flushing and let us know how that works out. > > There are no known memory leaks in recent version of auditd. I try to keep > > malloc down to a minimum to prevent this and memory fragmentation to creep > > in. > > With; > * flush = none Completely different behaviour from previous, memory usage > never changed for my entire test run > * flush = data No increase in memory usage at all > * flush = sync No increase in memory usage at all > > Changing the ext3 barrier setting didn't make any changes to the above > results nor to the behaviour I saw when "incremental" was set. > > Well as the other settings are better behaved I can change to using "data" > without any problems I believe. Arguably this is probably a better choice > for me anyway! > > Thanks for your help! Sure. -Steve