diff --git a/userspace/engine/falco_engine.cpp b/userspace/engine/falco_engine.cpp index 7f3d18f3..45f455c2 100644 --- a/userspace/engine/falco_engine.cpp +++ b/userspace/engine/falco_engine.cpp @@ -444,6 +444,11 @@ void falco_engine::clear_filters() } } +void falco_engine::clear_loader() +{ + m_rule_loader.clear(); +} + void falco_engine::set_sampling_ratio(uint32_t sampling_ratio) { m_sampling_ratio = sampling_ratio; diff --git a/userspace/engine/falco_engine.h b/userspace/engine/falco_engine.h index 9d8d7cce..8a558f51 100644 --- a/userspace/engine/falco_engine.h +++ b/userspace/engine/falco_engine.h @@ -118,6 +118,15 @@ public: // Clear all existing filters. void clear_filters(); + // + // Clear all the definitions of the internal rule loader (e.g. defined + // rules, macros, lists, engine/plugin version requirements). This is meant + // to be used to free-up memory at runtime when the definitions are not + // used anymore. Calling this between successive invocations of load_rules + // or load_rules_file can cause failures of features like appending. + // + void clear_loader(); + // // Set the sampling ratio, which can affect which events are // matched against the set of rules. diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp index 0255e028..308cb6b7 100644 --- a/userspace/falco/falco.cpp +++ b/userspace/falco/falco.cpp @@ -763,6 +763,9 @@ int falco_init(int argc, char **argv) } } + // Free-up memory for the rule loader, which is not used from now on + engine->clear_loader(); + for (auto substring : app.options().disabled_rule_substrings) { falco_logger::log(LOG_INFO, "Disabling rules matching substring: " + substring + "\n");