Hello,

Has anyone observed any memory leaks with the community edition of nxlog v2.1.2148 on Windows (2008R2, 2012, and 2012R2)?

On our busier servers, we periodically will see a burst of errors like the following in the nxlog.log file:
2015-04-12 12:22:09 ERROR EvtNext failed with error 14: Not enough storage is available to complete this operation.

2015-04-12 12:22:10 ERROR EvtUpdateBookmark failed: The handle is invalid.

2015-04-12 12:22:11 ERROR EvtNext failed with error 14: Not enough storage is available to complete this operation.

2015-04-12 12:22:11 ERROR EvtUpdateBookmark failed: The handle is invalid.

(These two errors can take up megabytes of space in the logfile.)

Once I see these errors, nxlog is effectively "mute" until I restart it.

I currently have a system where this has happened, and the nxlog process is taking over 700MB of RAM. I do have nxlog configured with pm_buffer (memory), with a buffer size of 100MB. If it's helpful, I've included my config below (flattened and comments removed -- it was spread across two files with one including the other).

For troubleshooting memory leaks on Linux, I've seen comments about using Valgrind. Is there something comparable for Windows?
Thanks,

- Daniel

###############################################################################

define ROOT C:\Program Files (x86)\nxlog
define EVLOGHOST ip_address_of_my_loghost

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension json>
Module xm_json
</Extension>

<Extension xml>
Module xm_xml
</Extension>

<Processor membuffer>
Module pm_buffer
MaxSize 102400
Type Mem
WarnLimit 76800
</Processor>

<Input internal>
Module im_internal
Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
</Input>

<Input eventlog>
Module im_msvistalog

Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000;
Exec $EventType = lc(string($EventType));
Exec $FileName = lc(string($FileName));
Exec $Hostname = lc(string($Hostname));
Exec $Severity = lc(string($Severity));
Exec delete($SourceModuleType);
Exec delete($EventTimeWritten);
Exec delete($EventTime);
Exec rename_field("Message", "full_message");
Exec if ($IpAddress =~ /::ffff:(.*)/) $IpAddress = $1;
Exec to_json();
</Input>

<Output EventLogOut>
Module om_tcp
Host %EVLOGHOST%
Port 3515
</Output>

<Route EventLogRoute>
Path internal, eventlog => membuffer => EventLogOut
</Route>

###############################################################################