On Friday 2012-01-20 17:12, Marcin Mirosław wrote: >Hello! >I've noticed high size of kmalloc-512/2048 on my vps after a one, two >weeks of work. Example: > OBJS ACTIVE USE OBJ SIZE SLABS OBJ/SLAB CACHE SIZE NAME > 83440 83411 99% 0.57K 5960 14 47680K kmalloc-512 > 21615 21604 99% 2.07K 1441 15 46112K kmalloc-2048 >103776 103765 99% 0.31K 8648 12 34592K skbuff_head_cache > >I've done a little investigation (trial by error method) to discover >which process keep data in kmalloc. It looks those kmalloc are used by >modules from xtables-addons-1.39. I'm using ipset6, geoip, sysrq, >tarpit. I greped sources for string "kmalloc", kmalloc is used by sysrq >and geoip (in some other modules too but i don't use them). geoip uses vmalloc for its huge allocations, so that can't be it. The massive size of skbuff_head_cache would point towards there being a lot of dead skbs being held, which - in my nose - would smell of tarpit. Did you properly feed all packets that you tarpited also to -j CT --notrack? >I'd like to ask is such usage of memory ok? Which module could take so >much precious ram?:) (I suspect geoip). How much memory geoip can use in >worse case (db with ipv4 and ipv6)? The on-disk files for geoip are loaded verbatim into the kernel, so that would be only ~6 MB at worst for geoip, not 40+. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
