SecurityOnion uses syslog-ng version 3.3.4.dfsg-2ubuntu1 that has a known 
memory leak.

What steps will reproduce the problem?
1. let SecurityOnion run for a while
(2. run Bro and ELSA)
3. syslog-ng's memory usage will increase indefinitely

What is the expected output? What do you see instead?

expected: syslog-ng's memory usage shouldn't increase indefinitely

Are you using the new Security Onion 12.04?

Version 12.04.3

Did you install from the ISO image or did you install your own version of 
Ubuntu and then add our PPA and packages?

Install from ISO image.

---

syslog-ng 3.3.4.dfsg-2ubuntu1 is shipped with Ubuntu 12.04. It has a known 
memory leak, and it won't be patched in ubuntu 12.04
(see 
http://www.engardelinux.org/modules/index/list_archives.cgi?list=syslog-ng-users
&page=0036.html&month=2013-04)

Upgrading syslog-ng to 3.3.11 fixes the issue. I used the packages from 
http://packages.madhouse-project.org/ubuntu/, and also installed the libivykis 
dependency from there.

(Ubuntu Saucy includes syslog-ng 3.3.9 and ivykis 0.36.2. It seems those 
packages can be backported to 12.04 without many issues. I did not confirm 
3.3.9 fixes the issue)