Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proctree improvements (cont) #4572

Merged
merged 3 commits into from
Feb 6, 2025

Conversation

geyslan
Copy link
Member

@geyslan geyslan commented Feb 4, 2025

Continuation of #4540

Close: #4546

Ran these in main and proctree-the-third branches:

dist/tracee --metrics --pyroscope --pprof -s tree=2609608 -e sched_process_exec,sched_process_fork,sched_process_exit --proctree source=both --proctree disable-procfs -o none
dist/tracee --metrics --pyroscope --pprof -s tree=2241901 -e sched_process_exec,sched_process_fork,sched_process_exit --proctree source=both -o none

Stressor details:

Details
8 threads with 1_000_000 ops each running on:

cpu: AMD Ryzen 9 7950X 16-Core Processor
MemTotal: 64923992 kB (64GB)

procfs disabled

| Metric       | main              | proctree-the-third | % Diff (main vs. work)  |
|--------------|-------------------|--------------------|-------------------------|
| malloc avg   | 1,667,695         | 1,622,511          | -2.7%                   |
| heap avg     | 103MB             | 85MB               | -17.5%                  |
| heap obj avg | 752,513           | 685,354            | -8.9%                   |

procfs enabled

| Metric       | main.             | proctree-the-third | % Diff (main vs. work)  |
|--------------|-------------------|--------------------|-------------------------|
| malloc avg   | 2,097,349         | 2,015,099          | -3.9%                   |
| heap avg     | 189MB             | 136MB              | -28.0%                  |
| heap obj avg | 1,265,703         | 1,151,860          | -9.0%                   |

1. Explain what the PR does

1150c94 chore(proctree): use atomic types
989290e perf(proctree): centralize child and thread Maps
ecba829 perf(proctree)!: rearrange struct fields

989290e perf(proctree): centralize child and thread Maps

Previously, each Process maintained its own maps for children and
threads, leading to significant overhead in the process tree. This
commit moves those maps into the ProcessTree, which now centrally
manages the children and threads for every process.

Additionally, this change allows us to simplify the Process struct by
removing the dedicated mutex that was solely used for protecting the
individual maps.

ecba829 perf(proctree)!: rearrange struct fields

Mind the padding and the alignment of the fields to avoid wasting
memory.

BREAKING CHANGE: invoked_from_kernel, sched_process_exec event arg, is
now a bool.

2. Explain how to test it

3. Other comments

Mind the padding and the alignment of the fields to avoid wasting
memory.

BREAKING CHANGE: invoked_from_kernel, sched_process_exec event arg, is
now a bool.
Previously, each Process maintained its own maps for children and
threads, leading to significant overhead in the process tree. This
commit moves those maps into the ProcessTree, which now centrally
manages the children and threads for every process.

Additionally, this change allows us to simplify the Process struct by
removing the dedicated mutex that was solely used for protecting the
individual maps.
@geyslan geyslan force-pushed the proctree-the-third branch from 5c4afda to 1150c94 Compare February 6, 2025 19:24
Copy link
Collaborator

@rscampos rscampos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@geyslan
Copy link
Member Author

geyslan commented Feb 6, 2025

/fast-forward

@github-actions github-actions bot merged commit 1150c94 into aquasecurity:main Feb 6, 2025
41 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

reduce cpu/memory of proctree pkg
2 participants