I have a Linux server that is exhibiting what looks like a memory leak.
As I watch the memory usage (in top), it shows that the buffers are
increasing at a rate of approximatesly 1K per second.

I have been looking for this all weekend, and am at a loss for tracking
it down.

The box is an AMD AthlonXP 3000+ with 1G RAM, a 1G swap partition and a
3ware 8 port SATA RAID controller runing RAID 10 with 4 80Gig drives
active and one spare.

The system is running Linux kernel 2.4.26 (Lunar-Linux install,
linux-stable kernel). The only things running are MySQL v4.0.20, Apache
v2.0.50, bind v9.2.3, inn v2.4.1, mailman v2.1.5 (python v2.3.4),
openssh v3.8.1p1, proftp v1.2.9, and postfix v2.1.0. I am using
shorewall v2.0.3 for a firewall (iptables v1.2.11). Logging is using
sysklogd v1.4.1 and ulogd 1.00. All were built from source.

ps aux shows:

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.1 0.0 1360 496 ? S 06:22 0:14 init [3]
root 2 0.0 0.0 0 0 ? S 06:22 0:00 [keventd]
root 3 0.0 0.0 0 0 ? SN 06:22 0:00
[ksoftirqd_CPU0]
root 4 0.0 0.0 0 0 ? S 06:22 0:00 [kswapd]
root 5 0.0 0.0 0 0 ? S 06:22 0:00 [bdflush]
root 6 0.0 0.0 0 0 ? S 06:22 0:00 [kupdated]
root 7 0.0 0.0 0 0 ? S 06:22 0:00 [scsi_eh_0]
root 8 0.0 0.0 0 0 ? S 06:22 0:00 [knodemgrd_0]
root 10 0.0 0.0 0 0 ? S< 06:22 0:00 [mdrecoveryd]
root 9 0.0 0.0 0 0 ? S 06:22 0:00 [khubd]
root 11 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 56 0.0 0.0 1632 864 ? Ss 06:22 0:00 devfsd /dev
root 83 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 85 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 87 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 89 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 91 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 93 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 95 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 97 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 99 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 101 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 103 0.0 0.0 0 0 ? S 06:22 0:00 [kjournald]
root 1931 0.0 0.0 1452 572 ? Ss 06:22 0:00
/usr/sbin/klogd
root 1981 0.0 0.0 1552 668 ? Ss 06:22 0:00
/usr/sbin/syslogd
root 2139 0.0 0.4 3784 3784 ? SLs 06:22 0:00
/usr/sbin/ntpd -g
bind 2180 0.0 0.3 4540 3424 ? Ss 06:22 0:00
/usr/sbin/named -
nobody 2229 0.0 0.1 2420 1336 ? Ss 06:22 0:00 proftpd:
(accepti
root 2313 0.0 0.1 4300 1392 ? Ss 06:22 0:00
/usr/libexec/post
postfix 2323 0.0 0.1 4480 1572 ? S 06:22 0:00 qmgr -l
-t fifo -
root 2362 0.0 0.1 3204 1460 ? Ss 06:22 0:00
/usr/sbin/sshd
root 2408 0.0 0.0 1452 508 ? Ss 06:22 0:00 ulogd
--daemon
root 2457 0.0 0.6 12060 5848 ? Ss 06:22 0:00
/usr/sbin/httpd
root 2507 0.0 0.0 1576 708 ? Ss 06:22 0:00
/usr/sbin/crond
root 2513 0.0 0.1 2428 1208 ? S 06:22 0:00 /bin/sh
/usr/bin/
nobody 2561 0.0 0.7 12396 6624 ? S 06:22 0:00
/usr/sbin/httpd
nobody 2562 0.0 0.7 12344 6636 ? S 06:22 0:00
/usr/sbin/httpd
nobody 2563 0.0 0.7 12352 6608 ? S 06:22 0:00
/usr/sbin/httpd
nobody 2564 0.0 0.6 12304 6208 ? S 06:22 0:00
/usr/sbin/httpd
nobody 2565 0.0 0.7 12404 6668 ? S 06:22 0:00
/usr/sbin/httpd
mysql 2585 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mysql 2586 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mysql 2587 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mysql 2588 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mysql 2589 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mysql 2590 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mysql 2592 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mysql 2593 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mysql 2594 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mysql 2595 0.0 1.5 48184 13592 ? S 06:22 0:00
/usr/libexec/mysq
mailman 2597 0.0 0.6 8400 5744 ? Ss 06:22 0:00
/usr/bin/python /
root 2598 0.0 0.0 1344 436 vc/1 Ss+ 06:22 0:00
/sbin/agetty 3840
root 2599 0.0 0.0 1344 436 vc/2 Ss+ 06:22 0:00
/sbin/agetty 3840
root 2600 0.0 0.0 1344 436 vc/3 Ss+ 06:22 0:00
/sbin/agetty 3840
root 2601 0.0 0.0 1344 436 vc/4 Ss+ 06:22 0:00
/sbin/agetty 3840
root 2602 0.0 0.0 1344 436 vc/5 Ss+ 06:22 0:00
/sbin/agetty 3840
mailman 2603 0.0 0.6 8176 5516 ? S 06:22 0:00
/usr/bin/python /
mailman 2604 0.0 0.7 9240 6664 ? S 06:22 0:00
/usr/bin/python /
mailman 2605 0.0 0.7 9184 6628 ? S 06:22 0:00
/usr/bin/python /
mailman 2606 0.0 0.6 8176 5524 ? S 06:22 0:00
/usr/bin/python /
mailman 2607 0.0 0.6 8188 5556 ? S 06:22 0:00
/usr/bin/python /
mailman 2608 0.0 0.7 9216 6616 ? S 06:22 0:00
/usr/bin/python /
root 2609 0.0 0.0 1344 436 vc/6 Ss+ 06:22 0:00
/sbin/agetty 3840
mailman 2612 0.0 0.7 9200 6616 ? S 06:22 0:00
/usr/bin/python /
mailman 2613 0.0 0.6 8176 5524 ? S 06:22 0:00
/usr/bin/python /
root 2627 0.0 0.2 5904 1848 ? Ss 06:23 0:00 sshd:
rpyne [priv
rpyne 2629 0.0 0.2 5972 1840 ? S 06:23 0:00 sshd:
rpyne@pts/1
rpyne 2630 0.0 0.1 4748 1700 pts/1 Ss 06:23 0:00 -bash
root 2633 0.0 0.1 4768 1724 pts/1 S 06:23 0:00 -su
nobody 2641 0.0 0.7 12288 6536 ? S 06:26 0:00
/usr/sbin/httpd
nobody 2644 0.0 0.7 12292 6536 ? S 06:26 0:00
/usr/sbin/httpd
root 2685 0.0 0.1 1908 1040 pts/1 S+ 06:28 0:00 top
nobody 7109 0.0 0.7 12344 6584 ? S 07:24 0:00
/usr/sbin/httpd
news 8614 0.0 0.4 6600 3824 ? Ss 07:38 0:00
/usr/bin/innd -p
news 8615 0.0 0.1 2576 1324 ? S 07:38 0:00 /bin/sh
rc.news s
news 8618 0.0 0.3 4720 3024 ? SN 07:38 0:00
/usr/bin/perl -w
news 8625 0.0 0.1 2612 1368 ? S 07:39 0:00 /bin/sh
/usr/bin/
postfix 9089 0.0 0.1 4356 1416 ? S 07:59 0:00 pickup -l
-t fifo
news 23127 0.0 0.1 5240 1576 ? SN 08:45 0:00 - nnrpd:
wbar8.da
news 23267 0.0 0.0 1872 476 ? S 08:49 0:00 sleep 600
root 23283 0.0 0.2 5908 1852 ? Ss 08:57 0:00 sshd:
rpyne [priv
rpyne 23285 0.0 0.2 5896 1824 ? S 08:57 0:00 sshd:
rpyne@pts/0
rpyne 23286 0.0 0.1 4736 1688 pts/0 Ss 08:57 0:00 -bash
root 23289 0.0 0.1 4748 1704 pts/0 S 08:57 0:00 -su
root 23296 0.0 0.0 2196 768 pts/0 R+ 08:58 0:00 ps aux

Any direction in tracking this down will be greatly appreciated.

--Richard