rsyslogd 4.6.4, compiled with:
    FEATURE_REGEXP:             Yes
    FEATURE_LARGEFILE:          No
    FEATURE_NETZIP (message compression):   Yes
    GSSAPI Kerberos 5 support:      Yes
    FEATURE_DEBUG (debug build, slow code): No
    Atomic operations supported:        Yes
    Runtime Instrumentation (slow code):    No

By adding a simple if-then filter in a custom conf file I notice quite a large jump in the memory used by rsyslogd.

Using the vanilla Debian conf file with no custom rules:

 51956  1400  0.0

By adding just a single if-then filter rsyslogd seems to double its memory consumption:

117492  1420  0.0

The typical filter:

if $programname contains 'sshd' and $syslogfacility-text == 'auth' then /var/log/ssh_auth.log

Using pmap to debug, the only process that shows a increase in memory is [ anon ].

[anon]                         24944 90480
/lib/ld-2.11.3.so                128   128
/lib/libc-2.11.3.so             3444  3444
/lib/libdl-2.11.3.so            2064  2064
/lib/libnsl-2.11.3.so           2136  2136
/lib/libnss_compat-2.11.3.so    2080  2080
/lib/libnss_files-2.11.3.so     2100  2100
/lib/libnss_nis-2.11.3.so       2092  2092
/lib/libpthread-2.11.3.so       2144  2144
/lib/librt-2.11.3.so            2080  2080
[stack]                           84    84
/usr/lib/libz.so.        2140  2140
/usr/lib/rsyslog/imklog.so      2072  2072
/usr/lib/rsyslog/imuxsock.so    2060  2060
/usr/lib/rsyslog/lmnet.so       2068  2068
/usr/sbin/rsyslogd               320   320

Is there something wrong in my custom rule?


rsyslogd seems to have mapped some memory pages, but not actually used them. Your rsyslogd is taking whopping 0.0%, or 1.4 megabytes of your precious system memory. Your custom rule added 20 kilobytes to rsyslogd memory usage.

Virtual memory and Linux memory usage behaviour overall can be very confusing.

  • 1
    +1 This is virtual memory, not physical memory. Your OS can create enormous amounts of virtual memory effectively free. So there's no reason to care about it. – David Schwartz Jun 5 '12 at 8:44
  • So, I was looking at the wrong place than! I'd better get a good linux memory howto next time. Thanks. – ripat Jun 5 '12 at 11:21
  • 1
    You said confusing? lwn.net/Articles/230975 – ripat Jun 5 '12 at 11:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.