Hello, On Sun, 22 Oct 2017 19:12:34 +0300 Lev Olshvang <levonshe(a)yandex.com&gt; wrote: Yes. Auparse library is heavy on malloc. This is known for a long time. My main goal was to get it working nice and correct and then spend time optimizing it. glibc malloc is slower but finds memory corruption better. This work is on the roadmap for the audit-2.9 series of releases. One quick and easy fix might be to recompile with jemalloc. There are a number of possible ways to fix this that I have been thinking about. One is lazy parsing where we only extract the timestamp and parse the rest if needed. Another might be to just build a list of pointers and lengths rather than mallocing each piece. Those things can disappear and you never know what was there. And some people have to maintain logs for 3 years on an archive server. Its way too late to lookup that info for activity that happened so long ago. The whole OS may have been upgraded. I'd be curious if switching to jemalloc helps. I think its a matter of adding its header to any file that has malloc and then updating the appropriate LDADD lines in Makefile.am. -Steve