Bug 238526

Summary: praudit using lots of swap/memory
Product: Base System Reporter: Wallace <incin>
Component: binAssignee: freebsd-bugs (Nobody) <bugs>
Status: New ---    
Severity: Affects Only Me CC: dvl, lacibsd, thogard
Priority: ---    
Version: 12.0-RELEASE   
Hardware: amd64   
OS: Any   

Description Wallace 2019-06-12 17:22:54 UTC
I have some new Dell servers on FreeBSD 12.0-RELEASE that are hungry for swap and memory.

It seems like the praudit process just keeps growing in size and doesn't stop. Servers do a similar task but are physically the same. 

ServerA:

uptime
 5:15PM  up 4 days, 22:29, 2 users, load averages: 0.86, 2.29, 2.84

CPU:  1.4% user,  0.0% nice,  1.2% system,  0.0% interrupt, 97.4% idle
Mem: 286M Active, 56G Inact, 6884M Laundry, 27G Wired, 1506M Buf, 2838M Free
ARC: 3887M Total, 256M MFU, 3388M MRU, 15M Anon, 37M Header, 191M Other
     3120M Compressed, 10G Uncompressed, 3.20:1 Ratio
Swap: 16G Total, 1264M Used, 15G Free, 7% Inuse

97831 root          1  20    0  7547M  6606M audit_  15  18:43   0.00% praudit

12.0-RELEASE-p3

This server had to be rebooted the other day since it ran out of swap space and crashed.

ServerB:

uptime
 5:18PM  up 42 days,  3:19, 2 users, load averages: 2.12, 1.90, 1.85

CPU:  3.7% user,  0.0% nice,  3.0% system,  0.0% interrupt, 93.4% idle
Mem: 2829M Active, 37G Inact, 17G Laundry, 34G Wired, 1552M Buf, 2180M Free
ARC: 11G Total, 2290M MFU, 8669M MRU, 89M Anon, 66M Header, 248M Other
     8299M Compressed, 20G Uncompressed, 2.43:1 Ratio
Swap: 16G Total, 16G Used, 4944K Free, 99% Inuse

84360 root          1  20    0    32G    16G audit_  24  58:26   0.07% praudit

12.0-RELEASE-p3

Thank you.
Comment 1 Laszlo Danielisz 2019-06-12 17:39:26 UTC
I'm also interested in solving this
Comment 2 Dan Langille freebsd_committer freebsd_triage 2024-02-05 19:14:43 UTC
And well, it affects me too. This is still an issue on FreeBSD 13.2
Comment 3 Tim Hogard 2024-02-06 03:39:10 UTC
This may be a malloc+calloc type memory leak in the GET_TOKEN_AREA macro in contrib/openbsm/libbsm/bsm_token.c