1memleak(8) System Manager's Manual memleak(8)
2
6 memleak - Print a summary of outstanding allocations and their call
7 stacks to detect memory leaks. Uses Linux eBPF/bcc.
8
10 memleak [-h] [-p PID] [-t] [-a] [-o OLDER] [-c COMMAND] [--combined-
11 only] [--wa-missing-free] [-s SAMPLE_RATE] [-T TOP] [-z MIN_SIZE] [-Z
12 MAX_SIZE] [-O OBJ] [INTERVAL] [COUNT]
13
15 memleak traces and matches memory allocation and deallocation requests,
16 and collects call stacks for each allocation. memleak can then print a
17 summary of which call stacks performed allocations that weren't subse‐
18 quently freed.
19 When tracing a specific process, memleak instruments a list of alloca‐
21 tion functions from libc, specifically: malloc, calloc, realloc,
22 posix_memalign, valloc, memalign, pvalloc, aligned_alloc, and free.
23 When tracing all processes, memleak instruments kmalloc/kfree,
24 kmem_cache_alloc/kmem_cache_free, and also page allocations made by
25 get_free_pages/free_pages.
26 memleak may introduce significant overhead when tracing processes that
28 allocate and free many blocks very quickly. See the OVERHEAD section
29 below.
30 This tool only works on Linux 4.6+. Stack traces are obtained using the
32 new BPF_STACK_TRACE` APIs. For kernels older than 4.6, see the version
33 under tools/old. Kernel memory allocations are intercepted through
34 tracepoints, which are available on Linux 4.7+.
35
38 CONFIG_BPF and bcc.
39
41 -h Print usage message.
42 -p PID Trace this process ID only (filtered in-kernel). This traces
44 libc allocator.
45 -t Print a trace of all allocation and free requests and results.
47 -a Print a list of allocations that weren't freed (and their sizes)
49 in addition to their call stacks.
50 -o OLDER
52 Print only allocations older than OLDER milliseconds. Useful to
53 remove false positives. The default value is 500 milliseconds.
54 -c COMMAND
56 Run the specified command and trace its allocations only. This
57 traces libc allocator.
58 --combined-only
60 Use statistics precalculated in kernel space. Amount of data to
61 be pulled from kernel significantly decreases, at the cost of
62 losing capabilities of time-based false positives filtering
63 (-o).
64 --wa-missing-free
66 Make up the action of free to alleviate misjudgments when free
67 is missing.
68 -s SAMPLE_RATE
70 Record roughly every SAMPLE_RATE-th allocation to reduce over‐
71 head.
72 -t TOP Print only the top TOP stacks (sorted by size). The default
74 value is 10.
75 -z MIN_SIZE
77 Capture only allocations that are larger than or equal to
78 MIN_SIZE bytes.
79 -Z MAX_SIZE
81 Capture only allocations that are smaller than or equal to
82 MAX_SIZE bytes.
83 -O OBJ Attach to allocation functions in specified object instead of
85 resolving libc. Ignored when kernel allocations are profiled.
86 INTERVAL
88 Print a summary of outstanding allocations and their call stacks
89 every INTERVAL seconds. The default interval is 5 seconds.
90 COUNT Print the outstanding allocations summary COUNT times and then
92 exit.
93
95 Print outstanding kernel allocation stacks every 3 seconds:
96 # memleak 3
97 Print user outstanding allocation stacks and allocation details for the
99 process 1005:
100 # memleak -p 1005 -a
101 Sample roughly every 5th allocation (~20%) of the call stacks and print
103 the top 5
104 stacks 10 times before quitting. # memleak -s 5 --top=5 10
105 Run ./allocs and print outstanding allocation stacks for that process:
107 # memleak -c ./allocs
108 Capture only allocations between 16 and 32 bytes in size:
110 # memleak -z 16 -Z 32
111
113 memleak can have significant overhead if the target process or kernel
114 performs allocations at a very high rate. Pathological cases may
115 exhibit up to 100x degradation in running time. Most of the time, how‐
116 ever, memleak shouldn't cause a significant slowdown. You can use the
117 -s switch to reduce the overhead further by capturing only every N-th
118 allocation. The -z and -Z switches can also reduce overhead by captur‐
119 ing only allocations of specific sizes.
120 Additionally, option --combined-only saves processing time by reusing
122 already calculated allocation statistics from kernel. It's faster, but
123 lacks information about particular allocations.
124 Also, option --wa-missing-free makes memleak more accuracy in the com‐
126 plicated environment.
127 To determine the rate at which your application is calling malloc/free,
129 or the rate at which your kernel is calling kmalloc/kfree, place a
130 probe with perf and collect statistics. For example, to determine how
131 many calls to __kmalloc are placed in a typical period of 10 seconds:
132 # perf probe '__kmalloc'
134 # perf stat -a -e 'probe:__kmalloc' -- sleep 10
136
139 This is from bcc.
140 https://github.com/iovisor/bcc
142 Also look in the bcc distribution for a companion _examples.txt file
144 containing example usage, output, and commentary for this tool.
145
147 Linux
148
150 Unstable - in development.
151
153 Sasha Goldshtein
154USER COMMANDS 2016-01-14 memleak(8)