search

wazuh / wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
https://wazuh.com/
Other
9.34k stars 1.48k forks source link

Increase of memory usage by wazuh-modulesd #23304

Closed MARCOSD4 closed 1 week ago

MARCOSD4 commented 1 week ago
Wazuh version Component Install type Install method Platform
4.8.0-rc1 Wazuh component Manager Packages CentOS

Description

During testing in Release 4.8.0 - RC 1 - Footprint Metrics - ALL it has been detected a high increase of memory usage by wazuh-modulesd. This has been seen in PSS, RSS_MAXMIN, RSS and USS metrics. Increase in wazuh-modulesd is expected as indicated here, but what we are seeing in this case is a much larger increase (more than threefold) so we think it should be investigated.

Plots are compared to https://github.com/wazuh/wazuh/issues/23174.

Release/Stage RSS Issue
4.8.0-rc1 image https://github.com/wazuh/wazuh/issues/23290
4.7.4-RC2 image https://github.com/wazuh/wazuh/issues/23174
Release/Stage PSS Issue
4.8.0-rc1 image https://github.com/wazuh/wazuh/issues/23290
4.7.4-RC2 image https://github.com/wazuh/wazuh/issues/23174
Release/Stage USS Issue
4.8.0-rc1 image https://github.com/wazuh/wazuh/issues/23290
4.7.4-RC2 image https://github.com/wazuh/wazuh/issues/23174

More information can be found on the issue and in this comment.

Rebits commented 1 week ago

Related https://github.com/wazuh/wazuh/issues/22841

Dwordcito commented 1 week ago

Probably related to: https://github.com/wazuh/wazuh/issues/23202

Dwordcito commented 1 week ago

The requirements due for the refactor are different in comparison with 4.7.4, the new implementation uses a different cache for high-speed read access. Explained in https://github.com/wazuh/wazuh/issues/22841

Furthermore, we change in https://github.com/wazuh/wazuh/issues/23202 the write buffer to prevent high memory allocations. this may decrease the values ​​in the results.