[ale] Memory leak (hacked?)

David Corbin dcorbin at machturtle.com
Sun Apr 11 19:04:25 EDT 2004


On Friday 09 April 2004 10:35, Dow Hurst wrote:
> My wife's box has those in the logs sporadically.  Every distro of SuSE
> I've tried so far still generates those.  I believe it is the motherboard
> hardware and the ethernet module that generates them.  Cheap hardware most
OK, now I know this is wierd, but here is what I've figured out.

1) I can boot from a live-CD and it doesn't leak
2) I built a new kernel on another machine, without module support, and it 
does leak.
3) If I remove /var/run/utmp, unmount /var, mount /var, the leak stops.

Yes, I know #3 is very wierd.  Any more suggestions? 

David

> likely.  It isn't sign of being hacked.  Under heavy load it increases.
>
> Now if you've got a hidden module inserted by a cracker then you may not
> know what is going on and the heavier load of whatever he/she is serving
> could increase the messages or start them.  So it could show your hacked.
>
> Just wanted to let you know that the message happens on other machines.
> Dow
>
> David Corbin wrote:
> > On Wednesday 07 April 2004 07:40, Geoffrey wrote:
> >>David Corbin wrote:
> >>>I have had my public server develop a sudden memory leak.   (Honest -
> >>>it is sudden - I've done nothing to that system recently).  I keep
> >>>ending up with the following kernel message: __alloc_pages: 0-order
> >>>allocation failed (gfp=0xf0/0)  repeatedly.
> >>>
> >>>When I reboot this morning, I watch top, and sure enough, you could
> >>>see the memory steadily creeping upwards.  This happens even when I
> >>>boot into single user mode, and have ridiculously free processes:
> >>
> >>Tried running top to see what is eating up your memory?  After starting
> >>top enter 'M' (that's uppercase m) and it will sort by memory usage.
> >>You should be able to identify the memory hog.
> >
> > Yes, I did, but I don't see anything growing in an individual process.
> > Only the total memory uses is growing.
> >
> > I have noticed some "Spurious 8259A Interrupt IRQ 7" messages showing up
> > on the console.



More information about the Ale mailing list