Memory Leak

[nook24]

Hi,
I'm facing memory leak issues when querying the Windows Event Log through this lib.

I'm new to Golang so properly I'm just doing something wrong. I found the issues #27 and #3 and maybe there is still a memory issue around.

I created a little code snip you can execute which shows the issue: https://github.com/nook24/wmi_windows_eventlog/blob/main/main.go

This Code is running on Windows Server 2016

Even if the numbers are different from what Task Manager reports the memory usage is rising in Task Manager as well.

[yusufozturk]

We are also having same issue and now we are testing it. Anybody else having the same problem?

[yusufozturk]

We are also having same issue and now we are testing it. Anybody else having the same problem?

In my case, it was due to wrong syscall usage. We use WMI heavily and it's good so far.

[nook24]

In my case, it was due to wrong syscall usage. We use WMI heavily and it's good so far.

What do you mean by wrong syscall usage? We are using WMI a lot, and it looks like that the memory leak does only happen when querying the Windows Event Log.
Do you also query the Windows Event Log and if yes, how does your implementation differ from my I posted above?

My current workaround for this is to use PowerShell and not WMI to get the Job done, but I din't like this: https://github.com/it-novum/openitcockpit-agent-go/blob/main/checks/eventlog_windows.go#L90-L117

[yusufozturk]

I mean, we have a lot of syscalls in the app and one of them was causing our memory leak. In your case, I wouldn't know. But we also have a lot of wmi calls and we don't have any memory leak at the moment, so maybe this package is not the reason.

Fyi, we use syscalls to collect event logs. Using wmi would be slower and would use more resources. I would suggest you to drop wmi calls for events.

For perfmon, I would also suggest syscalls.

[jesus-velez]

I found this on another thread @nook24 influxdata/telegraf#6807 (comment). Does this help?

[tlimoncelli]

NOTE: This project is no longer being actively maintained.

We recommend you refer to this fork: https://github.com/yusufpapurcu/wmi