search

wazuh / wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
https://wazuh.com/
Other
9.34k stars 1.48k forks source link

Increase in PSS, RSS, USS by Wazuh-logcollector #23302

Closed santipadilla closed 1 week ago

santipadilla commented 1 week ago
Wazuh version Component Install type Install method Platform
4.8.0-rc1 Wazuh Agent Agent Packages centOS

Description

During the testing in Release 4.8.0 - RC 1 - Footprint Metrics - LOGCOLLECTOR, SYSCOLLECTOR (2.5d) it has been detected a relevant increase of Wazuh-logcollector in RSS, PSS and USS on centOS.

The plots have been compared to Release 4.7.4 - RC 2 - Footprint Metrics - LOGCOLLECTOR, SYSCOLLECTOR (2.5d).

4.8.0-RC1 4.7.4-RC2
IMAGE IMAGE
4.8.0-RC1 4.7.4-RC2
IMAGE IMAGE
4.8.0-RC1 4.7.4-RC2
IMAGE IMAGE
4.8.0-RC1 4.7.3-RC2
IMAGE IMAGE
4.8.0-RC1 4.7.2-RC2
IMAGE IMAGE
TomasTurina commented 1 week ago

No big changes detected for logcolector code: https://github.com/wazuh/wazuh/compare/v4.7.4...4.8.0

Just a change from using fopen to use wfopen, which is the same in Linux.

image image image image image image

Function:

FILE * wfopen(const char * pathname, const char * mode) {
#ifdef WIN32
    ...
#else
    return fopen(pathname, mode);
#endif
}
TomasTurina commented 1 week ago

I've found similar results for 4.7.1 and 4.7.3 versions:

image

image

image

image

image

image

This is for sure a random behavior. The OS assigns memory at the start of the test that may not always be the same. If this test is re-run, it will probably show different results. The important thing here is that the memory usage doesn't increase during the test, in all versions it keeps a nearly constant value.

@vikman90 I think we can close this one.