[NTLUG:Discuss] where's the memory?

[kbrannen@gte.net]

I've got a SuSE 7.3 system (upgraded from 7.1) that seems to be leaking memory 
like a sieve (or almost that bad. :-)  Upon boot and starting X, I find that 
I'm using about 32M or so of memory.  However, after using the system for a 
few hours over several days, I'll suddenly notice that I've used almost all my 
physical RAM.  Like now! :-)

The "free" command shows:
              total    used    free  shared buffers  cached
Mem:        384648  352976   31672       0   28392   41476
-/+ buffers/cache:  283108  101540
Swap:       265060     796  264264

and my "xosview" shows that I'm using about 280M to 300M of memory, so those 2 
numbers match.  But when I whip up a little perl script to look at the output 
of "ps", things don't match up so nicely:

RSS SZ CMD       0 0
208 112 init     208 112
0 0 keventd      208 112
...
8472 4564 X      28832 34319  #the biggest process
...
1828 702 ps      47992 45271
1184 685 perl    49176 45956

I've only reproduced a few lines of the output.  Columns 1-3 are from "ps", 
column 4 is the current total of all the RSS values, while column 5 is the 
current total of all the SZ values.  So I read this as saying I should be 
using about 50M?

The script I used was:
ps -ely | perl -ne '@f = split; $r += $f[7]; $s += $f[8]; print "$f[7] $f[8] 
$f[12] \t $r $s\n"'

(If your system has an auto alias for ps like mine did, either do /bin/ps, or 
"unalias ps" first.)

At first I thought it was X cacheing a bunch of pixmaps or something and not 
letting go, now I'm not so sure.  Does anyone else know how I might track this 
down?  Or where the memory is going?

I've suspected the X server because if I shut down the X environment, then a 
"free" back at the console shows that I've recovered almost all of the "lost" 
memory (I log in non-X and use startx).

Thoughts?  Help?  Pointers?

Thanks,
Kevin