Skip to content

Conversation

@rscampos
Copy link
Collaborator

@rscampos rscampos commented Jul 29, 2024

1. Explain what the PR does

12c4a51 chore: release bpf object memory

These are the two references to the BPF object read from the file. Both
need to be set to nil for the Go garbage collector to reclaim the
memory.

2. Explain how to test it

To observe a real change in RSS, it's necessary to run Tracee with GOGC=5 to trigger the GC cycle more frequently. This approach allows for a clearer view of the improvement in RSS size.

sudo env GOGC=5 ./dist/tracee --events kill

RSS size before this commit:

ps -p `pgrep tracee` -o pid,vsz,rss,cmd
    PID    VSZ   RSS CMD
  29655 2269948 101512 ./dist/tracee --events kill

RSS size in this commit:

ps -p `pgrep tracee` -o pid,vsz,rss,cmd
    PID    VSZ   RSS CMD
  26268 2265800 87796 ./dist/tracee --events kill

With this chore, we achieve around a 14MB reduction in RSS, which corresponds to the size of each BPF object. This reduction was possible after a small fix in this libbpfgo PR#451

3. Other comments

These are the two references to the BPF object read from the file. Both
need to be set to nil for the Go garbage collector to reclaim the
memory.
Copy link
Member

@geyslan geyslan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rscampos rscampos merged commit 300cc58 into aquasecurity:main Jul 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants