falco: Memory leak on falco 0.16.0

What happened:

Falco has a memory leak :

Screenshot 2019-07-29 at 09 17 56

Screenshot 2019-07-29 at 13 13 36

Some systems are running Debian Jessie and 3.16.68-2 kernel version and falco 0.16.0.

These systems have services like OpenSSH, cron, Redis, MongoDB or RabbitMQ.

What you expected to happen:

Not to have these memory leaks.

How to reproduce it (as minimally and precisely as possible):

Just start it in the affected instances

Anything else we need to know?:

We are using the default rules and 6 rules that silence some core rules.

Environment:

  • Falco version (use falco --version): 0.16.0
  • System info <!-- Falco has a built-in support command you can use “falco --support | jq .system_info” -->
Mon Jul 29 11:11:34 2019: Falco initialized with configuration file /etc/falco/falco.yaml
Mon Jul 29 11:11:34 2019: Loading rules from file /etc/falco/falco_rules.yaml:
Mon Jul 29 11:11:35 2019: Loading rules from file /etc/falco/falco_rules.local.yaml:
Mon Jul 29 11:11:35 2019: Loading rules from file /etc/falco/k8s_audit_rules.yaml:
{
  "machine": "x86_64",
  "nodename": "int-wadus.xxx.yyy.zz",
  "release": "3.16.0-9-amd64",
  "sysname": "Linux",
  "version": "#1 SMP Debian 3.16.68-2 (2019-06-17)"
}
  • Cloud provider or hardware configuration: Amazon AWS
  • OS (e.g: cat /etc/os-release):
$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=debian
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
  • Kernel (e.g. uname -a):
$ uname -a
Linux int-wadus.xxx.yyy.zz 3.16.0-9-amd64 #1 SMP Debian 3.16.68-2 (2019-06-17) x86_64 GNU/Linux
  • Install tools (e.g. in kubernetes, rpm, deb, from source): deb
  • Others:

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Comments: 37 (28 by maintainers)

Most upvoted comments

Here’s the last update from @josacar ! The leak is definitely solved!

image

I sent @fntlnz massif dumps running slightly more than 24 hours:

image

Ok @josacar just started the latest patch, it looks like the first ten minutes are promising!! 🤞

image

If you need me to run massif again for longer time LMK.

@fntlnz What’s your timezone? Mine is CEST. I think I can isolate a server and do a call with you.