Replace SCLogError by a counter for memory issue and other memcap
Using a SCLogError for memcap or other memory issues can lead to a lot of messages. They should be replaced by some counters.
Updated by Eric Leblond about 7 years ago
- Subject changed from Replace SCLlogError by a counter for memory issue and other memcap to Replace SCLogError by a counter for memory issue and other memcap
We've got 145 occurances of 'SCLogError(SC_ERR_MEM_ALLOC' in the code. There is no way to know if a function is not an init function but to read it and understand its call graph. Doing that 145 may result in errors (for sure if I do it).
But even if it is done correctly we will need to have a lot of counters. Or we can just add one : malloc_failed.
On other complementary approach could be to rate limit this error message and use the previously mentioned counter.
What do you think ?
Updated by Victor Julien about 7 years ago
Rate limiting is something we need regardless, can you open a separate ticket for that?
I'm fine with a single malloc counter. I think we will have review which ones are important, like mallocs at detection time. Maybe you can do a coccinelle search and replace on SCLogError(SC_ERR_MEM_ALLOC and do a trivial change (like add a comment). Then in the pull request we can easily inspect them one by one. Make sense?