memleak(8) System Manager's Manual memleak(8)

# [NAME](#NAME)

memleak - Print a summary of outstanding allocations and their call stacks to detect memory leaks. Uses Linux eBPF/bcc.

# [SYNOPSIS](#SYNOPSIS)

**memleak \[-h] \[-p PID] \[-t] \[-a] \[-o OLDER] \[-c COMMAND] \[--combined-only]** \[--wa-missing-free] \[-s SAMPLE\_RATE] \[-T TOP] \[-z MIN\_SIZE] \[-Z MAX\_SIZE] \[-O OBJ] \[INTERVAL] \[COUNT]

# [DESCRIPTION](#DESCRIPTION)

memleak traces and matches memory allocation and deallocation requests, and collects call stacks for each allocation. memleak can then print a summary of which call stacks performed allocations that weren't subsequently freed.

When tracing a specific process, memleak instruments a list of allocation functions from libc, specifically: malloc, calloc, realloc, posix\_memalign, valloc, memalign, pvalloc, aligned\_alloc, and free. When tracing all processes, memleak instruments kmalloc/kfree, kmem\_cache\_alloc/kmem\_cache\_free, and also page allocations made by get\_free\_pages/free\_pages.

memleak may introduce significant overhead when tracing processes that allocate and free many blocks very quickly. See the OVERHEAD section below.

This tool only works on Linux 4.6+. Stack traces are obtained using the new BPF\_STACK\_TRACE\` APIs. For kernels older than 4.6, see the version under tools/old. Kernel memory allocations are intercepted through tracepoints, which are available on Linux 4.7+.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bcc.

# [OPTIONS](#OPTIONS)

[-h](#h)

Print usage message.

[-p PID](#p)

Trace this process ID only (filtered in-kernel). This traces libc allocator.

[-t](#t)

Print a trace of all allocation and free requests and results.

[-a](#a)

Print a list of allocations that weren't freed (and their sizes) in addition to their call stacks.

[-o OLDER](#o)

Print only allocations older than OLDER milliseconds. Useful to remove false positives. The default value is 500 milliseconds.

[-c COMMAND](#c)

Run the specified command and trace its allocations only. This traces libc allocator.

[--combined-only](#combined_only)

Use statistics precalculated in kernel space. Amount of data to be pulled from kernel significantly decreases, at the cost of losing capabilities of time-based false positives filtering (-o).

[--wa-missing-free](#wa_missing_free)

Make up the action of free to alleviate misjudgments when free is missing.

[-s SAMPLE\_RATE](#s)

Record roughly every SAMPLE\_RATE-th allocation to reduce overhead.

-t TOP

Print only the top TOP stacks (sorted by size). The default value is 10.

[-z MIN\_SIZE](#z)

Capture only allocations that are larger than or equal to MIN\_SIZE bytes.

[-Z MAX\_SIZE](#Z)

Capture only allocations that are smaller than or equal to MAX\_SIZE bytes.

[-O OBJ](#O)

Attach to allocation functions in specified object instead of resolving libc. Ignored when kernel allocations are profiled.

[INTERVAL](#INTERVAL)

Print a summary of outstanding allocations and their call stacks every INTERVAL seconds. The default interval is 5 seconds.

[COUNT](#COUNT)

Print the outstanding allocations summary COUNT times and then exit.

# [EXAMPLES](#EXAMPLES)

[Print outstanding kernel allocation stacks every 3 seconds:](#Print)

\# **memleak 3**

[Print user outstanding allocation stacks and allocation details for the process 1005:](#Print~2)

\# **memleak -p 1005 -a**

[Sample roughly every 5th allocation (~20%) of the call stacks and print the top 5](#Sample)

stacks 10 times before quitting. # **memleak -s 5 --top=5 10**

[Run ./allocs and print outstanding allocation stacks for that process:](#Run)

\# **memleak -c ./allocs**

[Capture only allocations between 16 and 32 bytes in size:](#Capture)

\# **memleak -z 16 -Z 32**

# [OVERHEAD](#OVERHEAD)

memleak can have significant overhead if the target process or kernel performs allocations at a very high rate. Pathological cases may exhibit up to 100x degradation in running time. Most of the time, however, memleak shouldn't cause a significant slowdown. You can use the -s switch to reduce the overhead further by capturing only every N-th allocation. The -z and -Z switches can also reduce overhead by capturing only allocations of specific sizes.

Additionally, option --combined-only saves processing time by reusing already calculated allocation statistics from kernel. It's faster, but lacks information about particular allocations.

Also, option --wa-missing-free makes memleak more accuracy in the complicated environment.

To determine the rate at which your application is calling malloc/free, or the rate at which your kernel is calling kmalloc/kfree, place a probe with perf and collect statistics. For example, to determine how many calls to \_\_kmalloc are placed in a typical period of 10 seconds:

\# **perf probe '\_\_kmalloc'**

\# **perf stat -a -e 'probe:\_\_kmalloc' -- sleep 10**

# [SOURCE](#SOURCE)

This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Sasha Goldshtein

2016-01-14 USER COMMANDS

---

Document: memleak(8) from bcc 0.37.0-r2 (Chainguard OS)
Source: https://github.com/iovisor/bcc