Memory-CPU LEAK

[catalans1980]

What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?

• I have searched the existing open and closed issues and I checked the docs https://docs.netalertx.com/

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Edge
• Safari (unsupported) - PRs welcome
• N/A - This is an issue with the backend

Current Behavior

The past 6th of April Netalertx updated. Since then, it seem to have a memory Leak. I'm running it in a Synology NAS DS720+, via portainer stack.

Expected Behavior

NOT having a memory leak

Steps To Reproduce

No response

Relevant app.conf settings

docker-compose.yml

Debug or Trace enabled

• I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

Relevant app.log section

  PASTE LOG HERE. Using the triple backticks preserves format.

Docker Logs

--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
* Creating DB locked log.
* Creating Execution queue log.
--> apply conf override.sh
--> override individual settings.sh
--> host optimization.sh
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh
--> host mode network.sh
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Excessive capabilities detected (bounding caps: 0x00000000a80435fb).
Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
required in this container. Please remove unnecessary capabilities.
https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities
══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
--> ports available.sh
Starting /usr/sbin/php-fpm83 -y "/services/config/php/php-fpm.conf" -F (tee stderr to app.php_errors.log)
Starting supercronic --quiet "/services/config/cron/crontab" >>"/tmp/log/cron.log" 2>&1 &
Starting /usr/sbin/nginx -p "/tmp/run/" -c "/tmp/nginx/active-config/nginx.conf" -g "error_log stderr; error_log /tmp/log/nginx-error.log; daemon off;" &
Starting python3 -m server > /tmp/log/stdout.log 2> >(tee /tmp/log/stderr.log >&2)
Successfully updated IEEE OUI database (113689 entries)

---

| \ | | | | / _ | | | | \ \ / /
| | | | |/ /\ \ | ___ _ _| | \ V /
| . |/ _ \ __| _ | |/ _ \ __| __|/
| |\ | __/ || | | | | / | | |_/ /^\
_| _/_|__| |/|___|| __/ /
Network intruder and presence detector.
https://netalertx.com
Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
══════════════════════════════════════════════════════════════════════════════
🚨 ALERT: Python execution capabilities (NET_RAW/NET_ADMIN) are missing.
The Python binary in this image has file capabilities (+eip) that
require these bits in the container's bounding set. Without them,
the binary will fail to execute (Operation not permitted).
Restart with: --cap-add=NET_RAW --cap-add=NET_ADMIN
══════════════════════════════════════════════════════════════════════════════
══════════════════════════════════════════════════════════════════════════════
⚠️ WARNING: Reduced functionality (NET_BIND_SERVICE missing).
Tools like nbtscan cannot bind to privileged ports (UDP 137).
This will reduce discovery accuracy for legacy devices.
Consider adding: --cap-add=NET_BIND_SERVICE
══════════════════════════════════════════════════════════════════════════════
Security context: Operational capabilities (CHOWN SETGID SETUID) not granted.
See https://docs.netalertx.com/docker-troubleshooting/missing-capabilities
--> mounts.py
Path | R | W | Mount | RAMDisk | Performance | DataLoss
--------------------------+---+---+-------+---------+-------------+----------
/data | ✅| ✅| ✅ | ➖ | ➖ | ✅
/data/db | ✅| ✅| ✅ | ➖ | ➖ | ✅
/data/config | ✅| ✅| ✅ | ➖ | ➖ | ✅
/tmp/run/tmp | ✅| ✅| ✅ | ✅ | ✅ | ✅
/tmp/api | ✅| ✅| ✅ | ✅ | ✅ | ✅
/tmp/log | ✅| ✅| ✅ | ✅ | ✅ | ✅
/tmp/run | ✅| ✅| ✅ | ✅ | ✅ | ✅
/tmp/nginx/active-config | ✅| ✅| ✅ | ✅ | ✅ | ✅
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
* Creating DB locked log.
* Creating Execution queue log.
--> apply conf override.sh
--> override individual settings.sh
--> host optimization.sh
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh
--> host mode network.sh
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Excessive capabilities detected (bounding caps: 0x00000000a80435fb).
Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
required in this container. Please remove unnecessary capabilities.
https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities
══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
--> ports available.sh
Starting /usr/sbin/php-fpm83 -y "/services/config/php/php-fpm.conf" -F (tee stderr to app.php_errors.log)
Starting supercronic --quiet "/services/config/cron/crontab" >>"/tmp/log/cron.log" 2>&1 &
Starting /usr/sbin/nginx -p "/tmp/run/" -c "/tmp/nginx/active-config/nginx.conf" -g "error_log stderr; error_log /tmp/log/nginx-error.log; daemon off;" &
Starting python3 -m server > /tmp/log/stdout.log 2> >(tee /tmp/log/stderr.log >&2)
Successfully updated IEEE OUI database (113807 entries)

[jokob-sk]

Might be related to #1555 - have a look and you can try the suggestion in that thread - if it fixes your issue I might implement the solution outlined there.

[jokob-sk]

Also, please try the netalertx-dev image - it might be fixed in the dev build

[catalans1980]

I've downgraded to version 26. I'll wait for a more stable version or keep it on that version for the time being. Thanks.

[huperaisan]

I have the exact same issue (Debian LXC running Docker), a slow ramp up in CPU and memory use. Reverted to previous version for now.

Before reverting, both db and db-wal files were at 21MB. The normal db size (or at least the size after reverting) is 6.1MB, though db-wal is still at 5.8MB, which seems big.

[legionGer]

Can’t really confirm this behavior on Ram on either alpine or Debian … I got a minimal increase of ram during usage which is to be expected when we are using TMFS and WAL … I think my increase is like 30 mb over 24h …
My CPU is sitting at like 0.5% stable when no scans are running.

Running 26.4.6

[jokob-sk]

@huperaisan can you test the netalertx-dev container if the issue persists?

[op4lat]

FWIW. I have the script below ran in a cron job every 3mins

docker stats --no-stream --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.MemPerc}}\t{{.NetIO}}" | awk 'NR==1 {print; next} {print | "sort -hk 3 -r"}' | grep neta

Dev version

devnetalertx              4.70%     140.4MiB / 2GiB       6.86%     0B / 0B
devnetalertx              32.33%    140.9MiB / 2GiB       6.88%     0B / 0B
devnetalertx              0.10%     152.2MiB / 2GiB       7.43%     0B / 0B
devnetalertx              0.16%     152.7MiB / 2GiB       7.46%     0B / 0B
devnetalertx              2.79%     152.4MiB / 2GiB       7.44%     0B / 0B
devnetalertx              98.56%    180.2MiB / 2GiB       8.80%     0B / 0B
devnetalertx              0.22%     154.3MiB / 2GiB       7.53%     0B / 0B
devnetalertx              0.17%     152.7MiB / 2GiB       7.46%     0B / 0B
devnetalertx              0.14%     152.7MiB / 2GiB       7.46%     0B / 0B
devnetalertx              0.10%     156.1MiB / 2GiB       7.62%     0B / 0B
devnetalertx              0.10%     156.2MiB / 2GiB       7.63%     0B / 0B
devnetalertx              0.09%     154.8MiB / 2GiB       7.56%     0B / 0B
devnetalertx              0.12%     157.4MiB / 2GiB       7.68%     0B / 0B
devnetalertx              0.15%     157.5MiB / 2GiB       7.69%     0B / 0B
devnetalertx              27.97%    156.8MiB / 2GiB       7.66%     0B / 0B
devnetalertx              25.27%    158.9MiB / 2GiB       7.76%     0B / 0B
devnetalertx              0.15%     158.7MiB / 2GiB       7.75%     0B / 0B
devnetalertx              28.56%    157.7MiB / 2GiB       7.70%     0B / 0B
devnetalertx              0.11%     157.8MiB / 2GiB       7.70%     0B / 0B
devnetalertx              0.12%     157.2MiB / 2GiB       7.67%     0B / 0B
devnetalertx              0.10%     158.7MiB / 2GiB       7.75%     0B / 0B
devnetalertx              0.13%     159MiB / 2GiB         7.76%     0B / 0B
devnetalertx              0.09%     158MiB / 2GiB         7.71%     0B / 0B
devnetalertx              15.95%    159.4MiB / 2GiB       7.78%     0B / 0B
devnetalertx              31.78%    159.2MiB / 2GiB       7.77%     0B / 0B
devnetalertx              16.88%    159.9MiB / 2GiB       7.81%     0B / 0B
devnetalertx              29.13%    159.4MiB / 2GiB       7.78%     0B / 0B
devnetalertx              29.34%    160.7MiB / 2GiB       7.85%     0B / 0B
devnetalertx              0.07%     160.4MiB / 2GiB       7.83%     0B / 0B
devnetalertx              0.11%     160.3MiB / 2GiB       7.83%     0B / 0B
devnetalertx              27.47%    160.3MiB / 2GiB       7.83%     0B / 0B
devnetalertx              0.08%     160.3MiB / 2GiB       7.83%     0B / 0B
devnetalertx              0.10%     160.5MiB / 2GiB       7.84%     0B / 0B
devnetalertx              33.59%    171.1MiB / 2GiB       8.35%     0B / 0B
devnetalertx              0.11%     160.5MiB / 2GiB       7.84%     0B / 0B

latest prod

newnetalertx              4.60%     136.3MiB / 2GiB       6.65%     0B / 0B
newnetalertx              4.72%     138MiB / 2GiB         6.74%     0B / 0B
newnetalertx              5.02%     140.4MiB / 2GiB       6.85%     0B / 0B
newnetalertx              32.68%    141.1MiB / 2GiB       6.89%     0B / 0B
newnetalertx              4.34%     142MiB / 2GiB         6.93%     0B / 0B
newnetalertx              7.35%     141.4MiB / 2GiB       6.90%     0B / 0B
newnetalertx              37.77%    144.3MiB / 2GiB       7.04%     0B / 0B
newnetalertx              11.18%    144.8MiB / 2GiB       7.07%     0B / 0B
newnetalertx              7.30%     150.5MiB / 2GiB       7.35%     0B / 0B
newnetalertx              11.26%    146.2MiB / 2GiB       7.14%     0B / 0B
newnetalertx              32.11%    146.1MiB / 2GiB       7.14%     0B / 0B
newnetalertx              6.06%     146.4MiB / 2GiB       7.15%     0B / 0B
newnetalertx              32.83%    148.7MiB / 2GiB       7.26%     0B / 0B
newnetalertx              4.58%     149.4MiB / 2GiB       7.30%     0B / 0B
newnetalertx              4.63%     148.4MiB / 2GiB       7.25%     0B / 0B
newnetalertx              33.22%    150.6MiB / 2GiB       7.35%     0B / 0B
newnetalertx              4.47%     150.5MiB / 2GiB       7.35%     0B / 0B
newnetalertx              19.49%    150.9MiB / 2GiB       7.37%     0B / 0B
newnetalertx              5.13%     151.1MiB / 2GiB       7.38%     0B / 0B
newnetalertx              4.13%     151.3MiB / 2GiB       7.39%     0B / 0B
newnetalertx              36.51%    151.2MiB / 2GiB       7.38%     0B / 0B
newnetalertx              4.82%     151.5MiB / 2GiB       7.40%     0B / 0B
newnetalertx              31.84%    151.8MiB / 2GiB       7.41%     0B / 0B
newnetalertx              4.02%     151.9MiB / 2GiB       7.41%     0B / 0B
newnetalertx              5.33%     152.2MiB / 2GiB       7.43%     0B / 0B
newnetalertx              34.50%    152.4MiB / 2GiB       7.44%     0B / 0B
newnetalertx              3.10%     153MiB / 2GiB         7.47%     0B / 0B
newnetalertx              36.41%    151.1MiB / 2GiB       7.38%     0B / 0B
newnetalertx              34.70%    151.9MiB / 2GiB       7.42%     0B / 0B
newnetalertx              28.25%    153.1MiB / 2GiB       7.48%     0B / 0B
newnetalertx              7.06%     153.3MiB / 2GiB       7.49%     0B / 0B
newnetalertx              36.18%    152.6MiB / 2GiB       7.45%     0B / 0B
newnetalertx              4.05%     153.7MiB / 2GiB       7.51%     0B / 0B
newnetalertx              34.91%    153.8MiB / 2GiB       7.51%     0B / 0B
newnetalertx              4.52%     154.3MiB / 2GiB       7.53%     0B / 0B
newnetalertx              5.61%     154.4MiB / 2GiB       7.54%     0B / 0B
newnetalertx              4.03%     155MiB / 2GiB         7.57%     0B / 0B
newnetalertx              4.29%     155.6MiB / 2GiB       7.60%     0B / 0B
newnetalertx              4.18%     155.8MiB / 2GiB       7.61%     0B / 0B
newnetalertx              4.04%     156.3MiB / 2GiB       7.63%     0B / 0B

So it seems like the dev version keeps the CPU less busy

Bonus

I ran first and left overnight the new version and noticed that both versions increase the memory usage (or is that accumulated memory used??). Here are the last lines of the log

Overnight

newnetalertx              4.32%     222.3MiB / 2GiB       10.85%    0B / 0B
newnetalertx              4.52%     222.8MiB / 2GiB       10.88%    0B / 0B
newnetalertx              4.07%     257.4MiB / 2GiB       12.57%    0B / 0B
newnetalertx              7.36%     223MiB / 2GiB         10.89%    0B / 0B
newnetalertx              102.27%   252.7MiB / 2GiB       12.34%    0B / 0B
newnetalertx              4.68%     223.5MiB / 2GiB       10.91%    0B / 0B
newnetalertx              4.53%     223.5MiB / 2GiB       10.91%    0B / 0B

[huperaisan]

@huperaisan can you test the netalertx-dev container if the issue persists?

I'm testing it now. It idles at around double the previous CPU, but the slow leak seems to have stopped, so that's good!

Netalertx is the gold trace in the following, the switch to the dev branch is ~4:20:

[a-bali]

Same issue here, there is a clear CPU & memory leak (drops are restarts). v26.4.6, deployed on k8s.

[jokob-sk]

@a-bali can you try the netalertx-dev container and compare?

[a-bali]

Sure, see below (72 and 48 hour views) The green line is v26.4.6, the yellow is dev-20260416-221411. CPU seems to be stable now, but memory is still increasing though much slower than previously.