1memleak(8)                  System Manager's Manual                 memleak(8)
2
3
4

NAME

6       memleak  -  Print  a  summary of outstanding allocations and their call
7       stacks to detect memory leaks. Uses Linux eBPF/bcc.
8

SYNOPSIS

10       memleak [-h] [-p PID] [-t] [-a] [-o OLDER]  [-c  COMMAND]  [--combined-
11       only]  [-s  SAMPLE_RATE]  [-T TOP] [-z MIN_SIZE] [-Z MAX_SIZE] [-O OBJ]
12       [INTERVAL] [COUNT]
13

DESCRIPTION

15       memleak traces and matches memory allocation and deallocation requests,
16       and  collects call stacks for each allocation. memleak can then print a
17       summary of which call stacks performed allocations that weren't  subse‐
18       quently freed.
19
20       When  tracing a specific process, memleak instruments a list of alloca‐
21       tion  functions  from  libc,  specifically:  malloc,  calloc,  realloc,
22       posix_memalign,  valloc,  memalign,  pvalloc,  aligned_alloc, and free.
23       When  tracing  all  processes,   memleak   instruments   kmalloc/kfree,
24       kmem_cache_alloc/kmem_cache_free,  and  also  page  allocations made by
25       get_free_pages/free_pages.
26
27       memleak may introduce significant overhead when tracing processes  that
28       allocate  and  free  many blocks very quickly. See the OVERHEAD section
29       below.
30
31       This tool only works on Linux 4.6+. Stack traces are obtained using the
32       new BPF_STACK_TRACE` APIs.  For kernels older than 4.6, see the version
33       under tools/old.  Kernel memory  allocations  are  intercepted  through
34       tracepoints, which are available on Linux 4.7+.
35
36

REQUIREMENTS

38       CONFIG_BPF and bcc.
39

OPTIONS

41       -h     Print usage message.
42
43       -p PID Trace  this  process  ID  only (filtered in-kernel). This traces
44              libc allocator.
45
46       -t     Print a trace of all allocation and free requests and results.
47
48       -a     Print a list of allocations that weren't freed (and their sizes)
49              in addition to their call stacks.
50
51       -o OLDER
52              Print  only allocations older than OLDER milliseconds. Useful to
53              remove false positives.  The default value is 500 milliseconds.
54
55       -c COMMAND
56              Run the specified command and trace its allocations  only.  This
57              traces libc allocator.
58
59       --combined-only
60              Use  statistics precalculated in kernel space. Amount of data to
61              be pulled from kernel significantly decreases, at  the  cost  of
62              losing  capabilities  of  time-based  false  positives filtering
63              (-o).
64
65       -s SAMPLE_RATE
66              Record roughly every SAMPLE_RATE-th allocation to  reduce  over‐
67              head.
68
69       -t TOP Print  only  the  top  TOP stacks (sorted by size).  The default
70              value is 10.
71
72       -z MIN_SIZE
73              Capture only allocations  that  are  larger  than  or  equal  to
74              MIN_SIZE bytes.
75
76       -Z MAX_SIZE
77              Capture  only  allocations  that  are  smaller  than or equal to
78              MAX_SIZE bytes.
79
80       -O OBJ Attach to allocation functions in specified  object  instead  of
81              resolving libc. Ignored when kernel allocations are profiled.
82
83       INTERVAL
84              Print a summary of outstanding allocations and their call stacks
85              every INTERVAL seconds.  The default interval is 5 seconds.
86
87       COUNT  Print the outstanding allocations summary COUNT times  and  then
88              exit.
89

EXAMPLES

91       Print outstanding kernel allocation stacks every 3 seconds:
92              # memleak 3
93
94       Print user outstanding allocation stacks and allocation details for the
95       process 1005:
96              # memleak -p 1005 -a
97
98       Sample roughly every 5th allocation (~20%) of the call stacks and print
99       the top 5
100              stacks 10 times before quitting.  # memleak -s 5 --top=5 10
101
102       Run ./allocs and print outstanding allocation stacks for that process:
103              # memleak -c ./allocs
104
105       Capture only allocations between 16 and 32 bytes in size:
106              # memleak -z 16 -Z 32
107

OVERHEAD

109       memleak  can  have significant overhead if the target process or kernel
110       performs allocations at  a  very  high  rate.  Pathological  cases  may
111       exhibit  up to 100x degradation in running time. Most of the time, how‐
112       ever, memleak shouldn't cause a significant slowdown. You can  use  the
113       -s  switch  to reduce the overhead further by capturing only every N-th
114       allocation. The -z and -Z switches can also reduce overhead by  captur‐
115       ing only allocations of specific sizes.
116
117       Additionally,  option  --combined-only saves processing time by reusing
118       already calculated allocation statistics from kernel. It's faster,  but
119       lacks information about particular allocations.
120
121       To determine the rate at which your application is calling malloc/free,
122       or the rate at which your kernel  is  calling  kmalloc/kfree,  place  a
123       probe  with  perf and collect statistics. For example, to determine how
124       many calls to __kmalloc are placed in a typical period of 10 seconds:
125
126       # perf probe '__kmalloc'
127
128       # perf stat -a -e 'probe:__kmalloc' -- sleep 10
129
130

SOURCE

132       This is from bcc.
133
134              https://github.com/iovisor/bcc
135
136       Also look in the bcc distribution for a  companion  _examples.txt  file
137       containing example usage, output, and commentary for this tool.
138

OS

140       Linux
141

STABILITY

143       Unstable - in development.
144

AUTHOR

146       Sasha Goldshtein
147
148
149
150USER COMMANDS                     2016-01-14                        memleak(8)