first time user with out of memory question

[Janning Vygen]

Hi

i am running a dedicated memcached server with 4 GB Ram on linux (debian 
stable) for php session data (kernel 2.6.8-2-k7-smp, memcached 1.1.12-1)
Two days ago i ran "out of memory". In the log it says 

   malloc(): Cannot allocate memory

and stats slab produced "out of memory" message, too. At this time it was 
impossible for many users to login to our web application.

first i wondered because the "STAT bytes" was far lower than "STAT 
limit_maxbytes". Then i read in the archives that memcached needs much more 
memory than bytes to save. (60%). thats ok. i restarted memcached to get it 
running again.

but i am concerned about it. As i have 3,5 GB dedicated to memached (-m 3584) 
it should not run out of memory.

but anyway: i thought that memcached would delete the oldest key to get space 
for a new key and you should never get an "out of memory" message as i am NOT 
running it with -M (-M is not the default, isn't it?)

but memcache is increasing memory since restart. Shouldn't it use old entries 
before? I set expiration to 600 seconds but oldest entries are as old as 
uptime:

STAT items:8:number 38371
STAT items:8:age 87089
STAT uptime 87091

Maybe i did something wrong with expiration time. But i set it to "time() + 
600". 

Is it possible that memcached hit an OS limit? a look at ulimit -a shows me:

core file size        (blocks, -c) 0
data seg size         (kbytes, -d) unlimited
file size             (blocks, -f) unlimited
max locked memory     (kbytes, -l) unlimited
max memory size       (kbytes, -m) unlimited
open files                    (-n) 1024
pipe size          (512 bytes, -p) 8
stack size            (kbytes, -s) 8192
cpu time             (seconds, -t) unlimited
max user processes            (-u) unlimited
virtual memory        (kbytes, -v) unlimited

i guess i have to check this "open files" limit as this limits memcached to 
1024 connections, right?

BTW: 'lsof | grep memcached' showed up some lines like this:

  memcached 8487    root   10u  sock  0,4   54375193 can't identify protocol

what does it mean??? Is it ok?

Ok, long post and i didn't got to a cool question which is easy to answer. 
Maybe somebody can give me a hint anyway. Any help is very appreciated.

kind regards,
janning