High RAM Usage with Concurrent Logging Mode in ModSecurity

Description

I am experiencing an issue where my application consumes a high amount of RAM when using the Concurrent Logging mode in ModSecurity. The memory usage increases gradually over time and does not decrease, even after periods of low activity, until I cleaned the logs.

Environment

• ModSecurity Version: 3.0.13
• Web Server: Nginx 1.27.1
• Application Details: a PHP-based web app
• Concurrent Logging Configuration:
  SecAuditLogType Concurrent
  SecAuditLogStorageDir /var/log/modsec/audit

Steps to Reproduce

1. Enable Concurrent Logging mode in ModSecurity configuration.
2. Run the application under normal traffic.
3. Monitor RAM usage over time (e.g., using top or htop or metric Grafana).
4. Observe that RAM usage increases continuously without dropping.
5. Clear the log in /var/log/modsec directory and watch the RAM decrease.

Expected Behavior

• RAM usage should remain stable or decrease during low traffic periods.

Actual Behavior

• RAM usage increases gradually and does not decrease, leading to potential memory exhaustion.

Additional Information

Ram increased from 300MiB to 4GiB in almost 30 days on nginx:

Ram usage reduced after cleaning up logs:

Request

I would appreciate any insights or solutions to mitigate this memory consumption issue. Is there a recommended configuration for Concurrent Logging to prevent memory leaks, or is this a bug?

Thank you for your help!

Start by reproducing the report with ModSecurity 3.0.13, Nginx 1.27.1, SecAuditLogType Concurrent, and SecAuditLogStorageDir /var/log/modsec/audit while monitoring RAM and audit-log growth. Compare memory before and after clearing the logs; done means the cause is identified and memory remains stable during sustained and low traffic.