And with the client being on for a day with logs being reloaded from where they left off, its very plausible that most of the buffers are full of data, so yea, your memory footprint makes total sense there.