pluto eats RAM

Hi there!

I've got a problem with Openswan 2.4.4 running with Kernel
2.4.28/KLIPS-patch. 6 tunnels are established on this box,
the clients have a short rekeying interval (2m) - after
3 - 4 days pluto consumes 200MB RAM till running out
of memory. Then the kernel begins to kill processes:

__alloc_pages: 0-order allocation failed (gfp=0x1d2/0)
__alloc_pages: 0-order allocation failed (gfp=0x1d2/0)
VM: killing process ipsec
__alloc_pages: 0-order allocation failed (gfp=0x1d2/0)
VM: killing process sh
__alloc_pages: 0-order allocation failed (gfp=0x1d2/0)
VM: killing process sh


I don't understand this, at the beginning it takes only
30 MB and it takes a long time till it rise.

Regars,

Matthias
_______________________________________________
Usersopenswan.org
http
://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with
Openswan: 
http://www.amazon.com/gp/product/1904811
256/104-3099591-2946327?n=283155

On Wed, 22 Feb 2006, Matthias Lembcke wrote:

> I've got a problem with Openswan 2.4.4 running with
Kernel
> 2.4.28/KLIPS-patch. 6 tunnels are established on this
box,
> the clients have a short rekeying interval (2m) - after
> 3 - 4 days pluto consumes 200MB RAM till running out
> of memory. Then the kernel begins to kill processes:
>
> __alloc_pages: 0-order allocation failed (gfp=0x1d2/0)
> __alloc_pages: 0-order allocation failed (gfp=0x1d2/0)
> VM: killing process ipsec
> __alloc_pages: 0-order allocation failed (gfp=0x1d2/0)
> VM: killing process sh
> __alloc_pages: 0-order allocation failed (gfp=0x1d2/0)
> VM: killing process sh
>
>
> I don't understand this, at the beginning it takes
only
> 30 MB and it takes a long time till it rise.

Please edit programs/pluto/Makefile and enable
-DLEAK_DETECTIVE
Then after one day, nicely restart openswan and it should
log a LOT of memory info. With those, we might be able to
detect it.

We haven't heard of this though. I wonder why you are
seeing
this. Are you sure it is pluto that is eating up all the
ram?

Paul
_______________________________________________
Usersopenswan.org
http
://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with
Openswan: 
http://www.amazon.com/gp/product/1904811
256/104-3099591-2946327?n=283155

Hi Paul,

>>I don't understand this, at the beginning it takes
only
>>30 MB and it takes a long time till it rise.
> 
> 
> Please edit programs/pluto/Makefile and enable
-DLEAK_DETECTIVE
> Then after one day, nicely restart openswan and it
should
> log a LOT of memory info. With those, we might be able
to
> detect it.

i'll give it a try. At first i need a test setup to do
this, the
other box is productive and the best workaround without much
attention is to restart pluto daily at night.

> We haven't heard of this though. I wonder why you are
seeing
> this. Are you sure it is pluto that is eating up all
the ram?

yes, i'm sure it's pluto, 'top' shows this (at the
moment 6.7%,
when running out of memory ca. 40%). I wonder where the
other
memory is going (can't find any other proccess, the
kernel?).

I've got other setups (FreeSWAN/OpenSWAN with previous
versions)
without this mem leak (also tried to change the HW without
success).

Regards,
Matthias
_______________________________________________
Usersopenswan.org
http
://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with
Openswan: 
http://www.amazon.com/gp/product/1904811
256/104-3099591-2946327?n=283155

Hi there,

>>We haven't heard of this though. I wonder why you
are seeing
>>this. Are you sure it is pluto that is eating up all
the ram?
> 
> 
> yes, i'm sure it's pluto, 'top' shows this (at the
moment 6.7%,
> when running out of memory ca. 40%). I wonder where the
other
> memory is going (can't find any other proccess, the
kernel?).
> 
> I've got other setups (FreeSWAN/OpenSWAN with previous
versions)
> without this mem leak (also tried to change the HW
without success).

also lsmod shows strange things according to the ipsec
module:

1 hour after a restart

Module                  Size  Used by    Not tainted
ipsec                 329664-70357

1 day after a restart
Module                  Size  Used by    Not tainted
ipsec                 329664-9326112

i've set the rekeying interval to the default values but no
success (with the ram).

Matthias
_______________________________________________
Usersopenswan.org
http
://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with
Openswan: 
http://www.amazon.com/gp/product/1904811
256/104-3099591-2946327?n=283155

On Thu, 23 Feb 2006, Matthias Lembcke wrote:

> also lsmod shows strange things according to the ipsec
module:
>
> 1 hour after a restart
>
> Module                  Size  Used by    Not tainted
> ipsec                 329664-70357
>
> 1 day after a restart
> Module                  Size  Used by    Not tainted
> ipsec                 329664-9326112
>
> i've set the rekeying interval to the default values
but no
> success (with the ram).

That has been fixed in the cvs version and should probably
already
be in 2.4.5rc5.

Paul
_______________________________________________
Usersopenswan.org
http
://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with
Openswan: 
http://www.amazon.com/gp/product/1904811
256/104-3099591-2946327?n=283155