Rss usage > a 4GB

Elastic Stack Beats
1

Hi,

I test it on Windows Server 2008 R2 and Win7, with topbeat 1.1.1 from the download page of elastic.

I run a special .exe (TestLimit from sysinternal) that allocate 15 GB of RAM on my machine. In the global memory usage I can see this usage, but in the process result I have these :

{"@timestamp":"2016-03-02T14:31:12.040Z","beat":{"hostname":"W2K8R2","name":"W2K8R2"},"count":1,"proc":{"cpu":{"user":11421,"user_p":0,"system":4156,"total":15577,"start_time":"Aug12"},"mem":{"size":4294967295,"rss":4294967295,"rss_p":0.2,"share":0},"name":"Testlimit64.exe","pid":3024,"ppid":0,"state":"running"},"type":"process"}

When you look at the rss, you can see that the value is equal to 2^32, so is the rss value store on a int32 ? I didn't see anything in the github repo.

In advance thanks.

2

You are probably hitting this issue. https://github.com/elastic/beats/issues/986

So you need a 64-bit build of Topbeat.

3

Do I need to compile it, or a compile version exist?

4

You would need to build it.

5

I found a place where you can download a 64-bit binary, but it's a development version taken directly from the latest build of the master branch (so no stability guarantees, changelog is here). http://build-eu-00.elastic.co/view/Beats/job/beats-package/ws/src/github.com/elastic/beats/dev-tools/packer/build/

The workspace containing the binaries gets deleted when a new build starts.

6

Thanks, I'm going to build it, it is really not that hard :slight_smile: thanks anyway

EDIT : here is the output

go get github.com/elastic/gosigar
# github.com/elastic/gosigar
cc1.exe: sorry, unimplemented: 64-bit mode not compiled in

so I will download it :smiley: