journald started to leak virtual memory after recent CVE fixes. In upstream bug report [1] it was bisected down to the following commit: [2d5d2e0cc5171c6795d2a485841474345d9e30ab] basic/process-util: limit command line lengths to _SC_ARG_MAX This could be a real problem, especially on 32bit arches with 3Gb limit of per-process virtual memory. An example from my armv7 board: $ sudo dmesg | tail -n10 [2628500.175655] systemd-journald[220]: Failed to write entry (20 items, 670 bytes), ignoring: Cannot allocate memory [2628500.189167] systemd-journald[220]: Failed to write entry (20 items, 684 bytes), ignoring: Cannot allocate memory [2628549.396897] systemd-journald[220]: Failed to write entry (20 items, 503 bytes), ignoring: Cannot allocate memory [2628549.462885] systemd-journald[220]: Failed to write entry (20 items, 499 bytes), ignoring: Cannot allocate memory [2628549.486545] systemd-journald[220]: Failed to write entry (20 items, 494 bytes), ignoring: Cannot allocate memory [2629089.528791] systemd-journald[220]: Failed to write entry (20 items, 496 bytes), ignoring: Cannot allocate memory [2629689.644943] systemd-journald[220]: Failed to write entry (20 items, 496 bytes), ignoring: Cannot allocate memory [2630289.851904] systemd-journald[220]: Failed to create new system journal: Cannot allocate memory [2630289.929109] systemd-journald[220]: Failed to create new user journal: Cannot allocate memory [2630289.948503] systemd-journald[220]: File /var/log/journal/eed2edca90707d8527f02e315b930758/system.journal corrupted or uncleanly shut down, renaming and replacing. $ ps auxwww | grep journal root 220 0.0 3.1 3122936 15764 ? Ss Jan27 2:29 /lib/systemd/systemd-journald There are several patches mentioned in upstream issue that should address this bug: [2], [3]. But I haven't tried them yet. [1] https://github.com/systemd/systemd/issues/11502 [2] https://github.com/systemd/systemd/pull/11527 [3] https://github.com/systemd/systemd/pull/11530
Is this fixed in 241?
Yes, this should be fixed in 241
This was also fixed in stable 239 and 240 branches
241 is being stabilized, so closing this.