Stats Panel

The Stats tab shows counts and throughput — live export metrics, per-index tables, charts, and Misc Stats.

Hover column headers and Misc Stats rows for tooltips. This page covers layout and run-level interpretation.

Dashboard layout

Top to bottom:

1. Throughput charts — File docs/sec, File KiB/sec, database docs/sec, database KiB/sec, plus JVM Heap (Used and Committed). One chart-style toggle in the legend applies to all five.
2. Metric cards — File Counts, Database Counts (when a database destination is configured), and Misc Stats. Copy above the cards exports all three sections as plain text.

Per-source traffic subrows break down live volume by Burp tool where applicable.

While export is stopped, the dashboard refreshes on a reduced cadence (one-fifth the active rate); full refresh resumes on Start. Chart style (Smooth, Simple, Accessible) persists across runs. The heap chart is JVM-wide — a non-zero baseline when stopped is normal.

Smooth uses denser spline interpolation, rounded joins, and extra Y-axis headroom so short throughput spikes remain fluid without clipping. It changes presentation only; it does not invent extra samples or alter the underlying counters.

File Counts and Database Counts

Card	When visible	What it shows
File Counts	File destination enabled	Per-index counts and session file totals
Database Counts	Database destination configured	Per-index counts for database pushes

Database Counts follows the delivery timeline from left to right: Index, Exported, Failures, Queued, Recovered Failures, Retry Drops, Permanent Drops, Last Bulk (ms), Last Error. Traffic source subrows and the Total row use the same order.

File Counts follows local artifact delivery: Index, Written, Failures, Retry Attempts, Baseline, Appended, Final Size, Integrity, Last Append (ms), Last Error. Baseline is the run-start size, Appended is this run's committed output, and Final Size / Integrity become authoritative after Stop validation. Last Append measures append completion, not an explicit disk flush.

Run caught up? Compare Log [StartupExport] / [SnapshotExport] completion lines (backlog done) with Failures vs Recovered Failures here (database caught up when they match, if retry recovery succeeds). See Log Panel — Run health.

Remote / non-local destinations: Histogram lulls and Failures ahead of Recovered Failures are normal while soft outage / cooldown runs — watch Database Capacity gauges. Wait / catch-up guidance: Config - Monitoring remote database exports.

Failures vs Recovered Failures - index totals are authoritative. Failures is a plain first-failure count of documents that reported a failed search push; it does not decrement on later success and is not a multi-round attempt counter (retry-drain re-pushes do not inflate it). Recovered Failures is later success via the retry drain (assumed while export is running). Outstanding is roughly Failures - Recovered Failures - Permanent Drops - Retry Drops. Queued, Recovered Failures, Retry Drops, and Permanent Drops then show the recovery path in chronological order; Misc Stats Retry Attempts counts drain re-pushes. Log emits DEBUG on each drain push and INFO when a drain push fails or recovers (recoveries may include evidence=bulk_item_success). Every Database Counts and File Counts column header has a tooltip. Traffic source subrows show route Failures and Recovered Failures when attributed; a dash on Recovered Failures means recoveries were index-only or ambiguous when session totals already balance.

Unrecovered failures after pressure clears: Keep the current run active while retry recovery catches up. Graceful Stop makes one bounded final drain; work still undrained at the deadline is reported as Permanent Drops and discarded rather than silently retained for a later Start. If the outstanding gap remains - especially on Amazon OpenSearch under sustained capacity pressure - a separate Files-only NDJSON run provides an importable fallback without adding more work to the pressured Database destination. Details: Config - File-only fallback.

Run boundary: Stop preserves that run's final counters and peaks in the panel for review. A subsequent Start resets run-scoped tables, counters, peaks, queues, and correlation metrics before new work is counted. This does not clear the Log panel; Log retention is controlled separately from its own Clear action.

Misc Stats groups

Hover each row. Parameter Integrity drill-down: Reference — Parameter integrity messages. stats_snapshot in OpenSearch: Exporter stats_snapshot in OpenSearch below.

Destination-gated visibility (current-run relevance):

• Files sections/rows only when the Files destination is selected.
• Database sections/rows only when the Database destination is selected.
• Both when both destinations are selected.
• Traffic Spill metrics (Overview Traffic Spill Status and the Traffic Spill detail group) show when live traffic export is relevant to the active sink(s).

There is no pace control in the UI. Shared AIMD capacity control applies to all search destinations. Larger destination capacity can improve throughput, while client backoff, spill, retry, and resume are designed to preserve progress on constrained deployments.

Overview

First Misc Stats section (product label Overview; older docs said Global). Row order:

Row	Meaning	Color
Export Running	Whether export is currently running.	Yes green / No red
Soft Outage	Yes while gateway/timeout/429-class pressure is pacing export via the shared cooldown and retry drain. The database destination stays enabled. Repeated auth 401/403 uses the separate Authorization Recovery state. Clears after meaningful payload / retry-drain progress - not from exporter log/stats singles alone. Soft Outage / hard cooldown can pause non-final exporter pushes.	Yes yellow / No green
Database Exported Size	Total bytes successfully exported to the search database this run (shown when Database is enabled).	Default font
Files Exported Size	Total bytes successfully written to the files destination this run (shown when Files is enabled).	Default font
Traffic Spill Status	Live-traffic overflow valve: Ready (empty), In use (holds backlog), Full (cannot accept more; new live traffic rejected so earliest backlog is kept). Complements Soft Outage across all search destinations.	Ready / In use default font; Full red

Proxy Correlation

Shown when live traffic export is relevant. This group describes the deterministic join between live Proxy HTTP callbacks and Burp Proxy History — waiting for exact History metadata, exporting after the bounded History-unavailable fallback, or rejecting unsafe correlation state.

Row	Meaning
Proxy / HTTP Request Callbacks	Proxy-specific request callbacks / global HTTP requests classified as Proxy (or Burp's null-source Proxy fallback). The two APIs are observational surfaces, not a shared ID namespace.
HTTP Marked / Responses	Global HTTP Proxy requests successfully given a private marker / corresponding live Proxy response callbacks observed. For a controlled workload these should converge.
Unmarked Tracked / Pre-Run	Responses expected to carry an active marker but missing one / responses that legitimately began before the run's marker intake. Tracked unmarked responses are explicit failures; pre-run responses are excluded from current-run eligibility.
History Lookups / Matched Rows	Background History lookup batches / token-bearing rows returned. Lookups are coalesced and normally read only newly appended History rows; this is not a per-request callback scan.
Pending Memory	Unresolved fresh documents retained in memory: document count / estimated bytes. The normal retention threshold is 15 seconds, but heap pressure can persist earlier.
Pending Durable	UI label for current-run temporary disk-backed overflow (not cross-run persistence): unresolved entries as count / estimated bytes. Heavy document maps are not kept in heap continuously. Discarded at Stop/unload; the next Start begins clean.
Bound / Eligible	Documents accepted by the traffic destination queue after exact binding or bounded History-unavailable fallback / documents admitted for current-run correlation. Bound converges to Eligible while the run remains active.
Durable Spool Total	UI label for how many current-run entries moved to that temporary overflow store. Overflow accounting only — not recovery across runs.
Lookup / Cleanup Failures	History access/application failures / failures removing the generated marker from live or History annotations.
Spool / Explicit Failures	Durable-store failures / active documents explicitly rejected because marker or generation invariants failed.

Healthy controlled-run expectations:

• HTTP Marked / Responses equal the live Proxy workload.
• Bound / Eligible converge after the near-real-time History join.
• Pending Memory / Pending Durable return to 0 / 0 B.
• Lookup / Cleanup Failures and Spool / Explicit Failures remain 0 / 0.

Pending Durable alone does not mean an incomplete export occurred. Despite the UI name, it is only current-run temporary overflow out of heap. After the correlation window, a complete downstream exchange can proceed with unavailable History-only metadata; Stop discards any unresolved remainder, and the next Start begins clean. See Reference — Live Proxy History-field correlation and Log — Live Proxy correlation lines.

Database Session

When a database destination is active, Database Session summarizes run-level delivery and recovery. Authorization Recovery shows No when normal, or the pause duration, retained retry backlog, and next automatic probe while repeated HTTP 401/403 responses are being recovered without stopping the run. Count Basis states that the live card, Database Counts table, Copy output, and Stop summaries use in-process session counters; Stop does not read database _count values back. Permanent Drops remains the authoritative total; Permanent Drop Reasons provides its stable reason breakdown as reason=count values:

Reason key	Meaning
max_fit_exceeded	A search document remained larger than the absolute 5 MiB bulk ceiling after deterministic structural fitting.
mapping_or_validation_rejected	A non-retryable mapping, parse, or validation rejection.
stop_discard	Bounded Stop/shutdown handling could not finish the document.
destination_unavailable	The configured database destination was unavailable or disabled before retry ownership could continue.
other	A permanent lifecycle path not covered by the stable categories above.

The same reason summary appears in Copy output and the Stop misc_stats JSON. File documents are never shortened by search fitting. Body Truncations counts unique database/search documents whose large fields were prefix-fitted, while Body Truncations by Index identifies the affected logical indexes. Stable operation IDs prevent retries or repeated fitting from inflating these totals.

Database Capacity

When a search database destination is active, Misc Stats includes a Database Capacity group (also in Copy clipboard text):

Row	Meaning
Bulk Byte Budget	Adaptive bulk payload ceiling shared by all search destinations. During export this is the live value; after Stop it retains the last active value from that run instead of displaying the controller's reset default. Each destination starts near 1 MiB, floors near 512 KiB under hard pressure, and can grow toward 5 MiB after healthy completed bulks.
Snapshot Flush Cap	How many snapshot bulk flushes may run in parallel - 1, 2, or 3 depending on shared AIMD health (drops under hard capacity pressure, restores when healthy). During export this is the live value; after Stop it retains the last active value from that run.
Snapshot Build-Ahead	Current quantized bytes and permits reserved by prepared snapshot documents waiting for chunk assembly, against the fixed 64 MiB / 1,024-permit envelope. It excludes active serialization and in-flight HTTP payloads.
Cooldown Remaining	Time left on the shared capacity cooldown before the next bulk send (- when idle).
Pressure Streak	Consecutive capacity events since the last successful bulk; drives cooldown escalation 5s → 15s → 30s → 60s.
Soft Outage Entries	How many times soft outage was entered this run (false → true). Resets on Start.
Capacity Events	How many times the shared cooldown was extended this run. Resets on Start.

Capacity pressure includes HTTP 429/502/503/504, timeout / failed-to-respond transport failures, and per-item circuit_breaking / throttled results even on HTTP 200. Mild per-item capacity is per-index (scope=index); hard gateway statuses remain cluster-wide (scope=cluster). Log cues: Amazon OpenSearch signals. Soft Outage Yes/No lives under Overview.

Traffic Spill

Live traffic only (mem queue → spill files → refill → bulk/file drain). Soft Outage does not call spill APIs; it causes spill by slowing drain. Snapshot indexes do not spill to disk.

Row	Meaning
Queue	Spill-file backlog when the in-memory traffic queue is full (N docs (X.X MiB)).
Oldest Age (s)	Age of the oldest spilled document.
Enqueued / Dequeued / Dropped	Spill lifetime counters.
Drop Reasons	Session totals: spill full / low-disk reject new / soft outage reject new / spill requeue failed / expired prune.

When status is Full, new live traffic is rejected (preserve earliest). That is not drop-oldest-on-spill-reject. Detail complements Overview Traffic Spill Status.

Database Run Peaks

Peak depths/waits observed during the current export run (reset on Start):

Row	Meaning
Peak Traffic Queue	Highest in-memory traffic queue depth.
Peak Traffic Spill	Highest Traffic Spill file backlog (product label; older docs said Peak Spill).
Peak Retry Queue	Highest retry-queue depth.
Peak Snapshot Chunk Target	Highest snapshot chunk target.
Peak Snapshot Flush (ms)	Longest completed single snapshot chunk flush wall time. This is not the cumulative flush time for an entire reporter backlog.
Peak Snapshot Build-Ahead	Highest quantized bytes and permits reserved in the snapshot preparation queue this run; use it with the live value to verify the 64 MiB bound independently of the JVM heap chart.
Peak Cooldown Wait (ms)	Longest shared capacity cooldown wait. Histogram gaps often match this or flush-slot waits.
Peak Flush Slot Wait (ms)	Longest wait for a snapshot flush slot. At ~120 s the watchdog warns, but the snapshot continues waiting for the transport timeout/retry outcome; Stop still cancels active run work.

Parameter Integrity wiki links

In-app Misc Stats tooltips cite Data Integrity guidance without clickable URLs. Match each row here:

Misc Stats row	Wiki detail
Mis-gate Suspects	misgate_binary
Skipped BODY Enumeration	Data Integrity overview
Wire BODY Replaced	wire_replaced, compressed_wire_body_params
Skip-path Rescued	skip_path_rescued
Supplemental BODY Used	supplemental_added
Supplemental Rejected (non-form)	supplemental_rejected_non_form
Wire BODY Dropped (entries)	wire_dropped, body_params_truncated

Resource phases and memory

Phase	Typical behaviour
Idle (loaded, export stopped)	No measurable memory growth from this extension; Stats dashboard refresh is quiesced.
Active export, moderate load	A few hundred MiB above baseline, dominated by Burp snapshot reads and configured queue depth.
Active export, heavy load	Bounded by traffic/retry queue capacity, a maximum 512 prepared snapshot documents, one heavy snapshot engine run at a time, the bulk payload cap, and in-flight bulks - not by total documents observed.
After Stop	Queues drain; connection pools close asynchronously. Committed JVM heap may remain elevated until the next GC cycle (OpenJDK behaviour).
After unload	Pools, schedulers, and session credentials are released; state resets for repeat-unload safety.

Reachable heap is not committed heap. OpenJDK does not return committed heap to the OS once allocated. Misc Stats surfaces Heap Used / Max and off-heap buffer pools so process RSS (Task Manager, Activity Monitor, or top/htop/ps) can be reconciled without guessing. If Burp's RSS climbs while export is stopped, check Misc Stats first — those rows are quiet by design while idle.

Misc Stats OpenSearch subgroups (Session, Traffic, Traffic Spill, Retry) help distinguish retained export work from a memory leak.

Stop reconciliation (Log panel lines)

On Stop, the exporter first attempts one final stats_snapshot write when Database and Exporter are active. It then validates selected Files artifacts and logs compact [Stats] Session stop JSON for file_counts (when Files is selected) and misc_stats. There is no Stop search_counts entry and no database _refresh / _count readback.

• File completion - file_counts carries the same Written, Failures, Retry Attempts, Baseline, Appended, Final Size, Integrity, Last Append, and Last Error values shown in File Counts / Copy.
• Database completion - Database Counts and Copy retain session counters. Destination-side totals remain queryable through that product's APIs after Stop.
• Final stats push - one last stats_snapshot to the Exporter index when applicable ([Stats] Final exporter stats push: success. or WARN on failure).

Compare session counters and stats_snapshot when troubleshooting delivery. Destination _count is available separately when a user needs destination-side validation; nested Lucene documents can inflate _cat/indices counts, while _count reports logical totals.

Amazon OpenSearch search-destination FAQ

Oddities seen on Amazon Hosted, Amazon Serverless, and stressed search destinations:

Observation	What it usually means
Quiet throughput charts, then a spike	Serverless cold start or first bulk after idle; not necessarily a hung export.
Chart lull while export stays green	Soft outage / shared cooldown / flush-slot wait — export is still enabled and pacing. Check Overview Soft Outage, Database Capacity, and Peak Cooldown Wait / Peak Flush Slot Wait under Database Run Peaks.
"Export stopped itself" but Config still Running	Soft outage or long cooldown — not an AUTH auto-disable. AUTH 401/403 disables Database; capacity pressure does not.
_cat/indices?v returns 403 on AOSS	Platform limitation for some cat APIs; use allowed index APIs / Dashboards instead of treating it as Burp auth failure.
Destination _count differs from session Exported	Stats intentionally reports this run's in-process counters and does not read _count at Stop. Destination _count can include earlier runs or externally imported data. Use a fresh index base for one-run comparisons; nested mappings inflate Lucene/_cat counts, so use _count for logical totals.
CloudWatch write-rejected=0 but Burp soft-outage	Client still saw gateway/timeout/item throttle; write-rejected is not the only capacity signal.
Failures == Recovered Failures after a noisy run	Drain recovered; outstanding is zero even if both counters are large.
Traffic sub-rows show - on Recovered	Recoveries were index-level / ambiguous while session totals already balance.
Purple / exporter series on charts	Exporter stats_snapshot traffic — expected when Exporter is selected, not proxy HTTP volume.
Permanent Drops after a second Stop	The first Stop may already have drained and closed the run; the second summary can repeat prior totals rather than identify new drops.

Under Hosted/gateway collapse, flat histograms plus Soft Outage and Traffic Spill Ready / In use / Full are expected. A findings stall reflects cross-index fairness (snapshot sources do not use disk spill), rather than a missing findings overflow path. Additional instance capacity or OCUs can improve throughput; client backoff, queueing, and resume provide the resilience path on constrained destinations. File-only catch-up: Config - File-only fallback.

Export accounting and diff validation

Document identity and dedupe

meta fields, OpenSearch _id assignment, bulk NDJSON shape, and in-run dedupe mechanisms: Reference - Document Identity, Dedupe, and Re-import.

Stats counters

Counters in StatsPanel, snapshot completion logs, and exporter stats_snapshot documents follow these semantics:

Counter	Meaning
Exported (OpenSearch)	Documents actually indexed this run (created + updated from bulk item result; noop and failures excluded)
Written (file)	Lines actually appended this run

Re-export expectations:

• Each newly prepared operation receives a client-generated UUID in Bulk action _id. That ID remains stable across retries, search fitting, spill, and the corresponding Files line pair, preventing duplicate creates for the same prepared operation.
• Re-sending the same NDJSON file uses the same action IDs and updates those documents. A later export run prepares new operation IDs, and append-mode Files output keeps the new action/document pairs after earlier content.
• On a fresh destination index, successful session Exported counts can be compared with _count. On reused indexes, _count is cumulative and can also include manual imports or other writers.

User checklist: After a fresh index export, compare StatsPanel Exported to _count on the traffic index. Counters reset on each Start (resetForRun). Exporter stats_snapshot uses indexes.<key>.exported and count (same value).

Exporter stats_snapshot in OpenSearch

When Exporter is selected, periodic stats_snapshot documents land in INDEX_BASE_NAME-exporter. Exporter stats_snapshot documents also carry spill depth, snapshot flush executor pressure, live bulk shape, run peaks, and sitemap filter summaries for post-run analysis.

• stats_snapshot event.data layout (nested): jvm - heap/non-heap/thread/GC fields. export - running, batch_size (shared BatchSizeController only; proxy history uses separate chunk sizing), throughput_docs_per_sec_60, optional start_to_first_traffic_ms, optional bulk_target_batch_last, optional bulk_attempted_docs_last. indexes - per key (traffic, exporter, settings, sitemap, findings) - { count, bytes, failures (optional) }. traffic - queue_size, queue_bytes_estimate, active_drain_batches, queue_drops, spill (including abandoned startup_discarded_count / startup_discarded_bytes), the complete proxy_correlation object described below, optional tool_source_fallback_hits, optional last_live_bulk_duration_ms (most recent live-drain bulk only; not proxy-history snapshot wall time), optional attribution (opensearch / file with sparse source and tool_type; source_failures / tool_type_failures only when traffic failures > 0; file omitted when file export off). stats - non-zero counters only, including sparse permanent_drop_reason_counts when permanent drops occur and sparse repeater_live_metadata_sources. proxy_history_last_run - after backlog snapshot (attempted, success, duration_ms, docs_per_sec, final_chunk_target, optional chunks, avg_chunk_docs, avg_chunk_bytes, optional build_wall_ms, build_cpu_ms, flush_ms, build_workers). event.summary - stats_snapshot. Sparse maps omit zero counters; file attribution is omitted when file export is off.

event.data.traffic.proxy_correlation is intentionally not sparse. Every stats snapshot contains the complete numeric contract:

proxy_request_callbacks, http_proxy_requests, http_marked_requests, http_proxy_responses, http_unmarked_tracked_responses, http_unmarked_prerun_responses, history_lookup_attempts, history_lookup_matched_rows, eligible_total, bound_total, pending_memory_count, pending_memory_bytes, pending_durable_count, pending_durable_bytes, durable_spooled_total, lookup_failures, cleanup_failures, spool_failures, and explicit_failures.

stats_snapshot field paths and example queries

Filter to stats documents with:

{ "term": { "event.type": "stats_snapshot" } }

Field path	Notes
event.data.indexes.traffic.count	Traffic docs indexed
event.data.indexes.traffic.bytes	Traffic bytes indexed
event.data.indexes.traffic.failures	Traffic push failures
event.data.indexes.*.bytes	Per-index bytes; sum in viz for session total
event.data.indexes.*.body_truncations	Sparse per-index search-fitting total; omitted when zero
event.data.jvm.heap_used_bytes	JVM heap used
event.data.export.running	Export running flag
event.data.export.batch_size	Shared batch size
event.data.export.throughput_docs_per_sec_60	60 s throughput
event.data.traffic.queue_size	Live traffic queue depth
event.data.traffic.proxy_correlation.eligible_total	Live Proxy documents admitted to bounded History enrichment
event.data.traffic.proxy_correlation.bound_total	Live Proxy documents handed to the traffic queue after exact binding or bounded History-unavailable fallback
event.data.traffic.proxy_correlation.pending_memory_count	Fresh unresolved correlation entries still represented in memory
event.data.traffic.proxy_correlation.pending_durable_count	Unresolved current-run entries represented in temporary disk-backed correlation storage
event.data.traffic.spill.startup_discarded_count	Abandoned spill documents discarded during safe managed-storage initialization; never replayed
event.data.traffic.proxy_correlation.history_lookup_attempts	Coalesced append/all-History lookup batches, not callback count
event.data.traffic.proxy_correlation.explicit_failures	Active documents rejected for marker/generation invariant failures
event.data.traffic.attribution.opensearch.source.proxy_history_snapshot	Proxy history snapshot attribution
event.data.traffic.attribution.opensearch.tool_type.REPEATER_TABS	Repeater Tabs tool attribution
event.data.stats.docs_with_skipped_body_enumeration_total	Body enumeration skips
event.data.stats.permanent_drop_reason_counts.max_fit_exceeded	Search documents that could not fit the absolute bulk ceiling
event.data.stats.snapshot_build_ahead.current_reserved_bytes	Current prepared snapshot build-ahead reservation
event.data.stats.snapshot_build_ahead.peak_reserved_bytes	Peak prepared snapshot build-ahead reservation this run
event.data.proxy_history_last_run.success	Last proxy history snapshot success

Traffic indexed over time (line chart):

{
  "size": 0,
  "query": { "term": { "event.type": "stats_snapshot" } },
  "aggs": {
    "over_time": {
      "date_histogram": { "field": "meta.indexed_at", "fixed_interval": "30s" },
      "aggs": {
        "traffic_docs": { "max": { "field": "event.data.indexes.traffic.count" } }
      }
    }
  }
}

Latest snapshot table (Discover columns): meta.indexed_at, event.data.export.running, event.data.indexes.traffic.count, event.data.indexes.sitemap.count, event.data.indexes.findings.count, event.data.indexes.exporter.count, event.data.jvm.heap_used_bytes, event.data.export.throughput_docs_per_sec_60.

Proxy history backlog (when present): event.data.proxy_history_last_run.attempted, event.data.proxy_history_last_run.duration_ms.

Log events (separate from stats): event.type: log. Stats snapshots use event.type: stats_snapshot only.

Traffic and memory (constraints)

• Behaviour: Traffic documents are built on the HTTP thread but not pushed there; they are offered to a bounded queue and a dedicated worker drains and sends via the compatible _bulk API (see Contributor Guide - Traffic export path). The traffic path uses chunked request body (NDJSON written incrementally from the queue) so we do not hold a full batch list or full BulkRequest in memory; only the queue and one doc in flight for serialization. Batching, time-based flush, and a 5MB cap per bulk request keep latency and memory in check.
• Managed temp root: Automatic, non-user-chosen exporter disk writes use one root named {java.io.tmpdir}/burp-exporter. Sensitive artifacts live below instances/<instance-id>/projects/<project-id>/..., not in shared flat spill directories.
• Instance ownership: Every loaded extension instance holds an operating-system lock on its instance tree. Directories and files must be real, non-symlink, owned by the running principal, and restricted to that owner. Startup cleans only abandoned unlocked instance trees; a live instance's tree is never traversed as abandoned data.
• Spill path: Current-run traffic overflow uses the active instance/project spill directory. Stop/unload discards it, and abandoned crash artifacts are discarded during a later safe startup; spill is never replayed into a new export run.
• Proxy correlation path: Current-run unresolved History joins use the active instance/project proxy-correlation directory. Disk-backed entries release heavy document maps from heap, but the directory is temporary overflow rather than persistent export storage.
• Managed disk cap: Exporter-managed usage is capped per Burp project across concurrent extension instances: 768 MiB for Traffic Spill and 256 MiB for Proxy correlation (1 GiB total per project). Cross-process quota reservations prevent two Burp instances from each consuming the full project allowance. This cap is separate from the destination volume free-space check described below.
• Low-disk rule: Before any exporter file write, preserve a 1 GiB free-space reserve on the target volume. When the write would breach that reserve, refuse the write, log an error, and update the UI status instead of continuing to consume disk until the volume is nearly full.
• Sink-specific low-disk behavior: If disk/file sink is the only active sink, low disk stops export and the control status reads Stopped due to low disk space. If OpenSearch remains enabled, local disk writes stop while OpenSearch export can continue; status identifies that only local disk writes stopped.
• Current write surfaces covered by the guard: traffic spill, Proxy correlation spool, transactional config export, JSON file creation, and exporter-managed temporary files. The Log panel has no save-to-file action. New file-writing paths use the same guard so low-disk behavior remains consistent.

In-process memory guards (catalog)

Canonical list for contributors; users use Misc Stats rows (hover for detail). Implementation detail: Contributor Guide.

Guard	Misc Stats signal
Bounded traffic queue + chunked NDJSON bulk	Traffic queue size/bytes, queue drops
Asynchronous Proxy History join + durable payload release	Proxy Correlation pending memory/durable rows
Adaptive batch size + 5 MiB payload cap	Current batch size, throughput
Bounded retry queues + retention eviction	Retry queue depth/bytes, drop reasons
Partitioned managed disk cap + 1 GiB free-space reserve	Spill queue docs/MiB and Proxy Correlation durable count/bytes/failures
Parameter-enumeration short-circuit	docs_with_skipped_body_enumeration in stats_snapshot
Idle dashboard quiesce (export stopped)	Dashboard refresh slows; see Resource phases
OpenSearch pool close on Stop/unload	Bulk in-flight returns to zero after Stop
Off-thread snapshots and HTTP enqueue	No OpenSearch calls on Burp HTTP thread
Snapshot pacing (SnapshotPacing)	EDT monitor lines in Log on tick budget miss

Memory observability surfaces

Misc Stats (Overview, Database / Database Capacity, Traffic, Traffic Spill, Retry, Database Run Peaks, JVM rollups) is the live surface. Copy exports File Counts + Database Counts + Misc Stats as plain text for bug reports. Dashboard is intentionally quiet when export is stopped.

Heap-vs-RSS reconciliation (OS process memory)

Committed JVM heap rarely returns to the OS after allocation — compare Misc Stats Heap Used / Max and direct/mapped buffer pools to Burp RSS in Task Manager, Activity Monitor, or top/htop/ps. Connection pools close on Stop/unload and rebuild lazily on next Start. The exporter does not call System.gc().

Retry behaviour and Log signals: Log Panel — Export retries and outage.