update(userspace): add method to clear rule loader state

Once all rule files have been loaded, and all the rules have been compiled into filters and inserted in the engine rulesets, the loader definitions are maintained in memory without really being used. This commit adds a convenience method to clear the loader state and free-up some memory when engine consumers do not require such information in memory anymore.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2022-04-14 09:01:15 +00:00 committed by poiana
parent 30fb58ed48
commit e1a5427874
3 changed files with 17 additions and 0 deletions

View File

@ -444,6 +444,11 @@ void falco_engine::clear_filters()
}
}
void falco_engine::clear_loader()
{
m_rule_loader.clear();
}
void falco_engine::set_sampling_ratio(uint32_t sampling_ratio)
{
m_sampling_ratio = sampling_ratio;

View File

@ -118,6 +118,15 @@ public:
// Clear all existing filters.
void clear_filters();
//
// Clear all the definitions of the internal rule loader (e.g. defined
// rules, macros, lists, engine/plugin version requirements). This is meant
// to be used to free-up memory at runtime when the definitions are not
// used anymore. Calling this between successive invocations of load_rules
// or load_rules_file can cause failures of features like appending.
//
void clear_loader();
//
// Set the sampling ratio, which can affect which events are
// matched against the set of rules.

View File

@ -763,6 +763,9 @@ int falco_init(int argc, char **argv)
}
}
// Free-up memory for the rule loader, which is not used from now on
engine->clear_loader();
for (auto substring : app.options().disabled_rule_substrings)
{
falco_logger::log(LOG_INFO, "Disabling rules matching substring: " + substring + "\n");