falco: Memory leak on falco 0.16.0
What happened:
Falco has a memory leak :


Some systems are running Debian Jessie and 3.16.68-2 kernel version and falco 0.16.0.
These systems have services like OpenSSH, cron, Redis, MongoDB or RabbitMQ.
What you expected to happen:
Not to have these memory leaks.
How to reproduce it (as minimally and precisely as possible):
Just start it in the affected instances
Anything else we need to know?:
We are using the default rules and 6 rules that silence some core rules.
Environment:
- Falco version (use
falco --version): 0.16.0 - System info <!-- Falco has a built-in support command you can use “falco --support | jq .system_info” -->
Mon Jul 29 11:11:34 2019: Falco initialized with configuration file /etc/falco/falco.yaml
Mon Jul 29 11:11:34 2019: Loading rules from file /etc/falco/falco_rules.yaml:
Mon Jul 29 11:11:35 2019: Loading rules from file /etc/falco/falco_rules.local.yaml:
Mon Jul 29 11:11:35 2019: Loading rules from file /etc/falco/k8s_audit_rules.yaml:
{
"machine": "x86_64",
"nodename": "int-wadus.xxx.yyy.zz",
"release": "3.16.0-9-amd64",
"sysname": "Linux",
"version": "#1 SMP Debian 3.16.68-2 (2019-06-17)"
}
- Cloud provider or hardware configuration: Amazon AWS
- OS (e.g:
cat /etc/os-release):
$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=debian
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
- Kernel (e.g.
uname -a):
$ uname -a
Linux int-wadus.xxx.yyy.zz 3.16.0-9-amd64 #1 SMP Debian 3.16.68-2 (2019-06-17) x86_64 GNU/Linux
- Install tools (e.g. in kubernetes, rpm, deb, from source):
deb - Others:
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Comments: 37 (28 by maintainers)
Here’s the last update from @josacar ! The leak is definitely solved!
I sent @fntlnz
massifdumps running slightly more than 24 hours:Ok @josacar just started the latest patch, it looks like the first ten minutes are promising!! 🤞
If you need me to run
massifagain for longer time LMK.@fntlnz What’s your timezone? Mine is CEST. I think I can isolate a server and do a call with you.