From e1a542787473e7201eb6514c7e3f773d35ba0c64 Mon Sep 17 00:00:00 2001 From: Jason Dellaluce Date: Thu, 14 Apr 2022 09:01:15 +0000 Subject: [PATCH] update(userspace): add method to clear rule loader state Once all rule files have been loaded, and all the rules have been compiled into filters and inserted in the engine rulesets, the loader definitions are maintained in memory without really being used. This commit adds a convenience method to clear the loader state and free-up some memory when engine consumers do not require such information in memory anymore. Signed-off-by: Jason Dellaluce --- userspace/engine/falco_engine.cpp | 5 +++++ userspace/engine/falco_engine.h | 9 +++++++++ userspace/falco/falco.cpp | 3 +++ 3 files changed, 17 insertions(+) diff --git a/userspace/engine/falco_engine.cpp b/userspace/engine/falco_engine.cpp index 7f3d18f3..45f455c2 100644 --- a/userspace/engine/falco_engine.cpp +++ b/userspace/engine/falco_engine.cpp @@ -444,6 +444,11 @@ void falco_engine::clear_filters() } } +void falco_engine::clear_loader() +{ + m_rule_loader.clear(); +} + void falco_engine::set_sampling_ratio(uint32_t sampling_ratio) { m_sampling_ratio = sampling_ratio; diff --git a/userspace/engine/falco_engine.h b/userspace/engine/falco_engine.h index 9d8d7cce..8a558f51 100644 --- a/userspace/engine/falco_engine.h +++ b/userspace/engine/falco_engine.h @@ -118,6 +118,15 @@ public: // Clear all existing filters. void clear_filters(); + // + // Clear all the definitions of the internal rule loader (e.g. defined + // rules, macros, lists, engine/plugin version requirements). This is meant + // to be used to free-up memory at runtime when the definitions are not + // used anymore. Calling this between successive invocations of load_rules + // or load_rules_file can cause failures of features like appending. + // + void clear_loader(); + // // Set the sampling ratio, which can affect which events are // matched against the set of rules. diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp index 0255e028..308cb6b7 100644 --- a/userspace/falco/falco.cpp +++ b/userspace/falco/falco.cpp @@ -763,6 +763,9 @@ int falco_init(int argc, char **argv) } } + // Free-up memory for the rule loader, which is not used from now on + engine->clear_loader(); + for (auto substring : app.options().disabled_rule_substrings) { falco_logger::log(LOG_INFO, "Disabling rules matching substring: " + substring + "\n");