The get_timestamp function in the auparse extension module seems to have an extra Py_INCREF. There's already a #FIXME at the line: https://fedorahosted.org/audit/browser/tags/audit-2.5.1/bindings/python/auparse_python.c#L1090.

Has this been investigated before? Rebuilding the package with that increment removed resolved our memory usage issues, so I'm hoping this doesn't silently break something.

-Santosh