Is my Fedora compromised? Massive Memory Leak

Ask Fedora
1

Hi Fedora Community!

I am experience a massive memory leak in F31 that forces me to restart the OS every day.

After 1-2 workdays my 12GB ram + 8GB swap will be gone, closing all apps recovers only a fraction of the memory. Exiting the GNome session does return most of the memory.

I have read that perhaps the system is compromised, and I should look for strange activity. I can find this strange network activity that I cannot map to any process.

tcp        0      0 127.0.0.1:1026          127.0.0.1:40618         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40626         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40660         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40598         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40684         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40700         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40602         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40590         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40620         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40644         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40584         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40600         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40672         TIME_WAIT  
tcp        0      0 127.0.0.1:1026          127.0.0.1:40670         TIME_WAIT  
...
62 connections in total

Anybody knows what this could be about? Either memory or network activity?

2

Hello @rvallel, I’m not a network expert, but TIME_WAIT indicates that the service that was using port 1026 on localhost closed the connection and represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request (Wikipedia).
TIME_WAIT is a normal state. Obviously, I think, if there are too many connections in this state, something is not working properly.

It looks like there is a process that always use port 1026. Maybe the process listening on port 1026 is still active, so we can isolate the issue? What is the result of this command?

sudo ss -napt state listening sport = :1026

2 Likes
3

Thanks! That pointed to the guilty application: Synology Cloud Drive.
For some reason nestat -p (to see the process) did not show
I think the issue might be that we use cloud driver over a VPN network and now it is turned off, Synology Cloud Drive might be endlesslyup anything, while your command clearly states the guilty process.

I killed the synchronization daemon, and all those entries are gone from netstat.

I still don’t know if those are responsible for the memory leak, will try to run the system without it for a few days…

Visibility of what is eating the memory is another issue.

2 Likes