Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: release bpf object memory #4209

Merged
merged 1 commit into from
Jul 29, 2024

Conversation

rscampos
Copy link
Collaborator

@rscampos rscampos commented Jul 29, 2024

1. Explain what the PR does

12c4a51 chore: release bpf object memory

These are the two references to the BPF object read from the file. Both
need to be set to nil for the Go garbage collector to reclaim the
memory.

2. Explain how to test it

To observe a real change in RSS, it's necessary to run Tracee with GOGC=5 to trigger the GC cycle more frequently. This approach allows for a clearer view of the improvement in RSS size.

sudo env GOGC=5 ./dist/tracee --events kill

RSS size before this commit:

ps -p `pgrep tracee` -o pid,vsz,rss,cmd
    PID    VSZ   RSS CMD
  29655 2269948 101512 ./dist/tracee --events kill

RSS size in this commit:

ps -p `pgrep tracee` -o pid,vsz,rss,cmd
    PID    VSZ   RSS CMD
  26268 2265800 87796 ./dist/tracee --events kill

With this chore, we achieve around a 14MB reduction in RSS, which corresponds to the size of each BPF object. This reduction was possible after a small fix in this libbpfgo PR#451

3. Other comments

These are the two references to the BPF object read from the file. Both
need to be set to nil for the Go garbage collector to reclaim the
memory.
Copy link
Member

@geyslan geyslan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rscampos rscampos merged commit 300cc58 into aquasecurity:main Jul 29, 2024
33 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants