[prev in list] [next in list] [prev in thread] [next in thread]
List: osiris
Subject: AW: [osiris] Memory consumption of osiris scanner on Windows
From: Peter.Frey () haufe ! de
Date: 2004-07-21 14:54:40
Message-ID: F5609E0662A8D611A25800508B692413065667C2 () VG200EXCH2
[Download RAW message or body]
Hi Brian,
> -----Ursprüngliche Nachricht-----
> Von: osiris-bounces+peter.frey=haufe.de@lists.shmoo.com
> [mailto:osiris-bounces+peter.frey=haufe.de@lists.shmoo.com]
> Im Auftrag von Brian Wotring
> Gesendet: Mittwoch, 21. Juli 2004 16:04
> An: Osiris Users
> Betreff: Re: [osiris] Memory consumption of osiris scanner on Windows
>
>
>
> Hi Peter,
>
> No, this is not a known issue, however, beta versions of the
> Windows agents and management console did have memory leaks
> related to OpenSSL on Windows. All of these leaks were
> believed to have been dealt with but it is possible that some
> have crept back in.
>
> There is no easy way to have the daemon restart itself after a scan.
> And, I don't feel comfortable with that as a solution. If
> there are memory leaks in the agent, it needs to be fixed, no
> questions. I will add this to the list of things to look at
> before the next release.
>
> p.s. Do you see any similar behavior in the management
> console, or have you taken notice?
I do not care about the management console, as it is run only occasionally
and closed again after use.
I checked with a production server (a database server) and here the observed
memory usage information over a couple of months
(collected at certain points in time using pslist -m, from
www.sysinternals.com):
(note in April we switched from PsList 1.23 to PsList 1.26, so the
difference in the headers)
for the osirisd process:
Pid VM WS WS Pk Priv Faults NonP Page
PageFile
2004-02-03_0745 1656 27628 2472 3540 1024 8174 3 26
1024
2004-02-24_2216 1960 24704 2436 2436 692 655 3 24
692
2004-03-05_0851 1960 27692 1152 3124 1032 10763 3 26
1032
2004-03-06_1126 1632 27628 3440 3540 1024 9174 3 26
1024
2004-03-11_0758 1532 27604 3416 3524 1008 8822 3 26
1008
2004-03-17_0735 836 550240 142968 143060 272568 93271 4 26
272568
2004-04-05_0809 1620 1336672 245364 437828 1291624 717050 4 26
1291624
Pid VM WS Priv Priv Pk Faults NonP
Page
2004-04-07_0844 1620 1500512 33292 1427500 1427604 792864 4 26
2004-04-14_1231 1620 550240 216160 476556 476660 142387 4 26
2004-05-15_0729 2784 25080 2472 716 716 660 3 24
2004-06-01_2054 5876 25080 2408 716 716 647 3 24
2004-06-15_2137 4236 157032 76088 73720 73824 27827 4 26
and for the osirism process (running on this machine):
2004-02-03_0745 1676 33784 3436 4952 1680 14585 13 28
1680
2004-02-24_2216 1800 33784 3976 5056 1392 11215 13 28
1392
2004-03-05_0851 1800 93176 2392 40668 3824 82000 14 28
3824
2004-03-06_1126 1652 33784 3948 6592 1248 15795 13 28
1248
2004-03-11_0758 1552 31656 4232 5888 1552 19452 14 29
1552
2004-03-17_0735 3592 287780 3336 103980 5236 120738 13 28
5236
2004-04-05_0809 1640 287780 3212 103624 3592 551620 13 28
3592
2004-04-07_0844 1640 287780 3084 3592 150528 558114
13 28
2004-04-14_1231 1640 43044 2544 1808 12016 41123
13 28
2004-05-15_0729 1652 156712 3056 2476 74380 174226
13 28
2004-06-01_2054 1652 157736 2696 3320 74380 260749
13 36
2004-06-15_2137 1652 156712 2988 4036 74380 324913
13 36
this is with osiris 3.0.4 that was installed on march 13th, before osiris
3.0.0 was running on this server.
osirism is not a problem, but osirisd does grows steadily over time, see 1.5
GB Virtual Memory on April 7th.
>
> Peter.Frey@haufe.de wrote:
> > Hi,
> >
> > we have a problem with the memory consumption of the osiris scanner
> > process (osirisd.exe) on our windows systems.
> > This is with osiris 4.0.1 (in production), but can also be
> observered
> > with osiris 4.0.3 (test environment)
> >
> > For example:
> >
> > after run 1:
> > Private Bytes: 52.312
> > Working Set: 54.788
> >
> > after run 2:
> > Private Bytes: 103.556
> > Working Set: 106.068
> >
> > After each run the working set and private bytes count (according to
> > ProcessExplorer) grows +50 KBytes,
> > the only way to get the scanner back to normal is by restarting it.
> >
> > Is this a known problem?
> > Also, is it possible to do an auto-restart of the osiris
> scanner e.g.
> > after each successfull scan,
> > to get rid of this memory overhead (that can grow to MBytes on long
> > running production systems)?
> >
> > Peter
> >
> >
> >
> ----------------------------------------------------------------------
> > --
> >
> > _______________________________________________
> > osiris mailing list
> > osiris@lists.shmoo.com
> > https://lists.shmoo.com/mailman/listinfo/osiris
>
>
> --
> Brian Wotring ( brian@shmoo.com )
> PGP KeyID: 0x9674763D
>
> _______________________________________________
> osiris mailing list
> osiris@lists.shmoo.com
> https://lists.shmoo.com/mailman/listinfo/osiris
>
[Attachment #3 (text/html)]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2657.73">
<TITLE>AW: [osiris] Memory consumption of osiris scanner on Windows</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>Hi Brian, </FONT>
</P>
<P><FONT SIZE=2>> -----Ursprüngliche Nachricht-----</FONT>
<BR><FONT SIZE=2>> Von: osiris-bounces+peter.frey=haufe.de@lists.shmoo.com </FONT>
<BR><FONT SIZE=2>> [<A \
HREF="mailto:osiris-bounces+peter.frey=haufe.de@lists.shmoo.com">mailto:osiris-bounces+peter.frey=haufe.de@lists.shmoo.com</A>] \
</FONT> <BR><FONT SIZE=2>> Im Auftrag von Brian Wotring</FONT>
<BR><FONT SIZE=2>> Gesendet: Mittwoch, 21. Juli 2004 16:04</FONT>
<BR><FONT SIZE=2>> An: Osiris Users</FONT>
<BR><FONT SIZE=2>> Betreff: Re: [osiris] Memory consumption of osiris scanner on \
Windows</FONT> <BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> Hi Peter,</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> No, this is not a known issue, however, beta versions of the \
</FONT> <BR><FONT SIZE=2>> Windows agents and management console did have memory \
leaks </FONT> <BR><FONT SIZE=2>> related to OpenSSL on Windows. All of these \
leaks were </FONT> <BR><FONT SIZE=2>> believed to have been dealt with but it is \
possible that some </FONT> <BR><FONT SIZE=2>> have crept back in.</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> There is no easy way to have the daemon restart itself after a \
scan. </FONT> <BR><FONT SIZE=2>> And, I don't feel comfortable with that as a \
solution. If </FONT> <BR><FONT SIZE=2>> there are memory leaks in the agent, \
it needs to be fixed, no </FONT> <BR><FONT SIZE=2>> questions. I will add \
this to the list of things to look at </FONT> <BR><FONT SIZE=2>> before the next \
release.</FONT> <BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> p.s. Do you see any similar behavior in the management \
</FONT> <BR><FONT SIZE=2>> console, or have you taken notice?</FONT>
</P>
<BR>
<P><FONT SIZE=2>I do not care about the management console, as it is run only \
occasionally and closed again after use.</FONT> </P>
<P><FONT SIZE=2>I checked with a production server (a database server) and here the \
observed memory usage information over a couple of months</FONT></P>
<P><FONT SIZE=2>(collected at certain points in time using pslist -m, from \
www.sysinternals.com):</FONT> </P>
<P><FONT SIZE=2>(note in April we switched from PsList 1.23 to PsList 1.26, so the \
difference in the headers)</FONT> </P>
<P><FONT SIZE=2>for the osirisd process:</FONT>
</P>
<P><FONT SIZE=2> \
Pid VM WS WS \
Pk Priv Faults NonP Page PageFile</FONT> <BR><FONT \
SIZE=2>2004-02-03_0745 1656 \
27628 2472 3540 \
1024 8174 3 \
26 1024</FONT> <BR><FONT \
SIZE=2>2004-02-24_2216 1960 \
24704 2436 2436 \
692 655 3 \
24 692</FONT> <BR><FONT \
SIZE=2>2004-03-05_0851 1960 \
27692 1152 3124 \
1032 10763 3 \
26 1032</FONT> <BR><FONT \
SIZE=2>2004-03-06_1126 1632 \
27628 3440 3540 \
1024 9174 3 \
26 1024</FONT> <BR><FONT \
SIZE=2>2004-03-11_0758 1532 \
27604 3416 3524 \
1008 8822 3 \
26 1008</FONT> <BR><FONT \
SIZE=2>2004-03-17_0735 836 550240 \
142968 143060 272568 93271 \
4 26 272568</FONT> <BR><FONT \
SIZE=2>2004-04-05_0809 1620 1336672 245364 \
437828 1291624 717050 4 26 \
1291624</FONT> </P>
<P><FONT SIZE=2> \
Pid VM \
WS Priv Priv Pk Faults NonP Page</FONT> \
<BR><FONT SIZE=2>2004-04-07_0844 1620 \
1500512 33292 1427500 1427604 792864 \
4 26</FONT> <BR><FONT \
SIZE=2>2004-04-14_1231 1620 550240 \
216160 476556 476660 142387 4 \
26</FONT> <BR><FONT SIZE=2>2004-05-15_0729 \
2784 25080 2472 \
716 716 660 \
3 24</FONT> <BR><FONT \
SIZE=2>2004-06-01_2054 5876 \
25080 2408 716 \
716 647 3 24</FONT> \
<BR><FONT SIZE=2>2004-06-15_2137 4236 \
157032 76088 73720 73824 \
27827 4 26</FONT> </P>
<BR>
<P><FONT SIZE=2>and for the osirism process (running on this machine):</FONT>
</P>
<P><FONT SIZE=2>2004-02-03_0745 1676 \
33784 3436 4952 \
1680 14585 13 28 \
1680</FONT> <BR><FONT SIZE=2>2004-02-24_2216 1800 \
33784 3976 5056 \
1392 11215 13 28 \
1392</FONT> <BR><FONT SIZE=2>2004-03-05_0851 1800 \
93176 2392 40668 \
3824 82000 14 28 \
3824</FONT> <BR><FONT SIZE=2>2004-03-06_1126 1652 \
33784 3948 6592 \
1248 15795 13 28 \
1248</FONT> <BR><FONT SIZE=2>2004-03-11_0758 1552 \
31656 4232 5888 \
1552 19452 14 29 \
1552</FONT> <BR><FONT SIZE=2>2004-03-17_0735 3592 \
287780 3336 103980 5236 \
120738 13 28 5236</FONT> <BR><FONT \
SIZE=2>2004-04-05_0809 1640 287780 \
3212 103624 3592 551620 \
13 28 3592</FONT> </P>
<P><FONT SIZE=2>2004-04-07_0844 \
1640 287780 3084 3592 \
150528 558114 13 28</FONT> <BR><FONT \
SIZE=2>2004-04-14_1231 \
1640 43044 2544 1808 \
12016 41123 13 28</FONT> \
<BR><FONT SIZE=2>2004-05-15_0729 \
1652 156712 3056 2476 \
74380 174226 13 28</FONT> <BR><FONT \
SIZE=2>2004-06-01_2054 \
1652 157736 2696 3320 \
74380 260749 13 36</FONT> <BR><FONT \
SIZE=2>2004-06-15_2137 \
1652 156712 2988 4036 \
74380 324913 13 36</FONT> </P>
<P><FONT SIZE=2>this is with osiris 3.0.4 that was installed on march 13th, before \
osiris 3.0.0 was running on this server.</FONT> <BR><FONT SIZE=2>osirism is not a \
problem, but osirisd does grows steadily over time, see 1.5 GB Virtual Memory on \
April 7th.</FONT> </P>
<P><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> Peter.Frey@haufe.de wrote:</FONT>
<BR><FONT SIZE=2>> > Hi,</FONT>
<BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> > we have a problem with the memory consumption of the \
osiris scanner </FONT> <BR><FONT SIZE=2>> > process (osirisd.exe) on our \
windows systems.</FONT> <BR><FONT SIZE=2>> > This is with osiris 4.0.1 (in \
production), but can also be </FONT> <BR><FONT SIZE=2>> observered </FONT>
<BR><FONT SIZE=2>> > with osiris 4.0.3 (test environment)</FONT>
<BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> > For example:</FONT>
<BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> > after run 1:</FONT>
<BR><FONT SIZE=2>> > Private Bytes: \
52.312</FONT> <BR><FONT SIZE=2>> > Working \
Set: 54.788</FONT> <BR><FONT \
SIZE=2>> > </FONT> <BR><FONT SIZE=2>> > after run 2:</FONT>
<BR><FONT SIZE=2>> > Private Bytes: \
103.556</FONT> <BR><FONT SIZE=2>> > Working \
Set: 106.068</FONT> <BR><FONT SIZE=2>> \
> </FONT> <BR><FONT SIZE=2>> > After each run the working set and private \
bytes count (according to</FONT> <BR><FONT SIZE=2>> > ProcessExplorer) grows \
+50 KBytes,</FONT> <BR><FONT SIZE=2>> > the only way to get the scanner back to \
normal is by restarting it.</FONT> <BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> > Is this a known problem?</FONT>
<BR><FONT SIZE=2>> > Also, is it possible to do an auto-restart of the osiris \
</FONT> <BR><FONT SIZE=2>> scanner e.g. </FONT>
<BR><FONT SIZE=2>> > after each successfull scan,</FONT>
<BR><FONT SIZE=2>> > to get rid of this memory overhead (that can grow to \
MBytes on long </FONT> <BR><FONT SIZE=2>> > running production systems)?</FONT>
<BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> > Peter</FONT>
<BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> \
----------------------------------------------------------------------</FONT> \
<BR><FONT SIZE=2>> > --</FONT> <BR><FONT SIZE=2>> > </FONT>
<BR><FONT SIZE=2>> > _______________________________________________</FONT>
<BR><FONT SIZE=2>> > osiris mailing list</FONT>
<BR><FONT SIZE=2>> > osiris@lists.shmoo.com</FONT>
<BR><FONT SIZE=2>> > <A HREF="https://lists.shmoo.com/mailman/listinfo/osiris" \
TARGET="_blank">https://lists.shmoo.com/mailman/listinfo/osiris</A></FONT> <BR><FONT \
SIZE=2>> </FONT> <BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> -- </FONT>
<BR><FONT SIZE=2>> Brian Wotring ( brian@shmoo.com \
)</FONT> <BR><FONT SIZE=2>> PGP KeyID: \
0x9674763D</FONT> <BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> _______________________________________________</FONT>
<BR><FONT SIZE=2>> osiris mailing list</FONT>
<BR><FONT SIZE=2>> osiris@lists.shmoo.com</FONT>
<BR><FONT SIZE=2>> <A HREF="https://lists.shmoo.com/mailman/listinfo/osiris" \
TARGET="_blank">https://lists.shmoo.com/mailman/listinfo/osiris</A></FONT> <BR><FONT \
SIZE=2>> </FONT> </P>
</BODY>
</HTML>
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic