On 2014-12-07 12:20, Roger Dingledine wrote:
Has anybody else here seen messages like this?
I looked through the old log files and found the following memory messages: Dec 06 03:33:06.000 [notice] Removed 334229280 bytes by killing 1 circuits; 16401 circuits remain alive. Dec 06 05:27:25.000 [notice] Removed 476998896 bytes by killing 1 circuits; 15628 circuits remain alive. Dec 06 06:08:35.000 [notice] Removed 536296464 bytes by killing 1 circuits; 16215 circuits remain alive. Dec 06 06:56:58.000 [notice] Removed 583650144 bytes by killing 1 circuits; 15617 circuits remain alive. Dec 06 07:55:57.000 [notice] Removed 857511072 bytes by killing 1 circuits; 15423 circuits remain alive. Dec 06 09:28:16.000 [notice] Removed 1040388096 bytes by killing 1 circuits; 14631 circuits remain alive.
To me it looks like an attacker that ramped up over a 6 hour period and then stopped building new circuits. Since the tor process still uses all available memory (more than 24 hours later) I guess the attacker still holds some circuits open. To what end I can't understand. He failed to crash the relay but wants to occupy my RAM? :)