I'm running Debian Jessie (actually Testing). I have another machine
that's still running fail2ban 0.8.13. Here's a status from that machine
but it's not exactly the same usage so the difference could definitely be
that:
VmPeak: 708612 kB
VmSize: 700352 kB
VmLck: 0 kB
VmPin: 0 kB
VmHWM: 15412 kB
VmRSS: 7600 kB
VmData: 655788 kB
VmStk: 136 kB
VmExe: 3188 kB
VmLib: 6060 kB
VmPTE: 212 kB
VmPMD: 12 kB
VmSwap: 4808 kB
Threads: 15
So if I understand correctly what you're saying, fail2ban mmaps the log
files into memory and then walks through the log causing them to page fault
into memory. This makes it look like it hogs memory with large logs but
the pages are not locked down and after a while the memory should be freed
back up if it's needed by other processes.
On Mon, Jun 22, 2015 at 8:08 PM, Lee Clemens <[email protected]> wrote:
> On 06/22/2015 02:29 PM, Michael Grant wrote:
> > PID USER PRI NI VIRT RES SHR S CPU% MEM% TIME+ Command
> >
> > 3196 root 20 0 1784M 373M 5008 S 0.4 18.8 1h16:47
> /usr/bin/python3 /usr/bin/fail2ban-server -s
> /var/run/fail2ban/fail2ban.sock -p /var/run/fail2
> >
> > VmPeak: 1827420 kB
> > VmSize: 1827416 kB
> > VmLck: 0 kB
> > VmPin: 0 kB
> > VmHWM: 539000 kB
> > VmRSS: 382460 kB
> > VmData: 1760668 kB
> > VmStk: 136 kB
> > VmExe: 3412 kB
> > VmLib: 7360 kB
> > VmPTE: 1412 kB
> > VmPMD: 20 kB
> > VmSwap: 158520 kB
> > Threads: 33
> >
> > So it's the VmHWM number I should be looking at? I'm almost a half gig
> (539MB) in that case. Why so much? Is it possible to reduce that
> footprint somehow? I have 2gig memory in this vm, that's like 25% of the
> total available physical memory for this one process. The 0.8 version I am
> sure didn't use but a small fraction of this.
>
> VmHWM is the High Water Mark, or Peak RSS, so may not be relevant for
> trending or real-time analysis.
>
> http://man7.org/linux/man-pages/man5/proc.5.html
>
> What was the VmHWM when running 0.8? Typical/average VmRSS? You need data
> from 0.8 if you wish to compare it with data from 0.9.
>
> It may be easier to assist you if we knew the OS your were using or you
> read http://www.fail2ban.org/wiki/index.php/HOWTO_Seek_Help
>
>
> >
> > On Mon, Jun 22, 2015 at 6:41 PM, Lee Clemens <[email protected]
> <mailto:[email protected]>> wrote:
> >
> > On 06/22/2015 01:26 PM, Orion Poplawski wrote:
> > > On 06/20/2015 12:25 PM, Michael Grant wrote:
> > >> I recently updated from 0.8.x to 0.9.2. fail2ban-server is now
> consuming a
> > >> gig+ of memory in my server. Before it was tiny fraction of this.
> > >>
> > >> I thought fail2ban just did a sort of complex grep though the
> tail of the
> > >> logs. Why would it need to keep huge amounts of data in memory?
> Things are
> > >> working fine but it's a huge resource hog. Is there something I
> can do to
> > >> reduce it's memory footprint without breaking something?
> > >
> > > What exactly to you mean by "consuming a gig+ or memory"?
> > >
> > > For example, on one of my machines, /proc/PID/status reports:
> > >
> > > VmPeak: 2277900 kB
> > > VmSize: 2205532 kB
> > > VmLck: 0 kB
> > > VmPin: 0 kB
> > > VmHWM: 79880 kB
> > > VmRSS: 69712 kB
> > > VmData: 598436 kB
> > > VmStk: 136 kB
> > > VmExe: 4 kB
> > > VmLib: 11428 kB
> > > VmPTE: 1952 kB
> > > VmSwap: 13824 kB
> >
> > For comparison:
> >
> > VmPeak: 916900 kB
> > VmSize: 915856 kB
> > VmLck: 0 kB
> > VmHWM: 20660 kB
> > VmRSS: 8532 kB
> > VmData: 709800 kB
> > VmStk: 88 kB
> > VmExe: 1500 kB
> > VmLib: 8420 kB
> > VmPTE: 352 kB
> > VmSwap: 11876 kB
> >
> > fail2ban 0.9.2 CentOS 6.6, 8 jails.
> >
> > [snip]
> >
> >
>
> ------------------------------------------------------------------------------
> > Monitor 25 network devices or servers for free with OpManager!
> > OpManager is web-based network management software that monitors
> > network devices and physical & virtual servers, alerts via email &
> sms
> > for fault. Monitor 25 devices for free with no restriction. Download
> now
> > http://ad.doubleclick.net/ddm/clk/292181274;119417398;o
> > _______________________________________________
> > Fail2ban-users mailing list
> > [email protected] <mailto:
> [email protected]>
> > https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> >
> >
>
------------------------------------------------------------------------------
Monitor 25 network devices or servers for free with OpManager!
OpManager is web-based network management software that monitors
network devices and physical & virtual servers, alerts via email & sms
for fault. Monitor 25 devices for free with no restriction. Download now
http://ad.doubleclick.net/ddm/clk/292181274;119417398;o
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
