diff --git a/auditd-plugin-clickhouse.cpp b/auditd-plugin-clickhouse.cpp index 07a9902..e8fbce9 100644 --- a/auditd-plugin-clickhouse.cpp +++ b/auditd-plugin-clickhouse.cpp @@ -1020,6 +1020,10 @@ int main(int argc, char **argv) if (readsize > 0) { auparse_feed(au.get(), data, readsize); + + // assume that data wasn't split, and flush it + // otherwise, libauparse keeps increasing it's memory footprint + auparse_flush_feed(au.get()); } else {