Skip to content
This repository has been archived by the owner on Apr 1, 2024. It is now read-only.

Apparent memory leak in Windows port of Zeek #40

Closed
philrz opened this issue Sep 23, 2020 · 3 comments
Closed

Apparent memory leak in Windows port of Zeek #40

philrz opened this issue Sep 23, 2020 · 3 comments
Labels
bug Something isn't working community

Comments

@philrz
Copy link

philrz commented Sep 23, 2020

In a Slack conversation a community user reported a possible memory leak when observing Brim's Zeek process running on Windows. I attempted to reproduce this and it does seem likely. Importing the 4 GB all.pcap we often test with into Brim v0.17.0 (so, using the Zeek artifact v3.2.0-dev-brim9) and watching in Task Manager, the reported memory use started around 80 MB and gradually climbed throughout the import to a peak of about 570 MB as it finished. Repeating the same on macOS, the Activity Monitor reported that Zeek's memory use ramped to 108.5 MB by the middle of the import process, and the usage remained flat throughout the remainder of import. While I know that Zeek maintains some state during its runs and I'm not surprised to see some ramp, clearly the slope on the Windows side is suspiciously high.

@philrz philrz added the bug Something isn't working label Sep 28, 2020
@philrz
Copy link
Author

philrz commented Aug 15, 2022

I've confirmed this issue is still present as of GA Brim tagged v0.31.0.

@philrz
Copy link
Author

philrz commented Jan 31, 2024

Now that Windows support for Zeek is more official and we're doing builds from current code in https://github.com/brimdata/build-zeek, I had high hopes that this problem would have gone away. Unfortunately it seems I can still reproduce it. I've opened an issue at zeek#3590.

@philrz
Copy link
Author

philrz commented Apr 1, 2024

As noted in the last comment, this memory leak is now being tracked in its proper home at zeek#3590. It probably doesn't make sense for us to hold redundant open issues for every problem we've found that ultimately needs to be fixed in another pcap analyzer. Per brimdata/brimcap#337, I plan to consolidate info about such issues in one location (probably the Brimcap wiki) and link to relevant issues from there.

In the meantime, I'm going to close this redundant issue.

@philrz philrz closed this as not planned Won't fix, can't repro, duplicate, stale Apr 1, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Something isn't working community
Projects
None yet
Development

No branches or pull requests

1 participant