Skip to content

Reduce resource footprint of project metrics updates#6655

Merged
nscuro merged 1 commit into
DependencyTrack:mainfrom
nscuro:reduce-project-metrics-update-io-cost
Jul 12, 2026
Merged

Reduce resource footprint of project metrics updates#6655
nscuro merged 1 commit into
DependencyTrack:mainfrom
nscuro:reduce-project-metrics-update-io-cost

Conversation

@nscuro

@nscuro nscuro commented Jul 12, 2026

Copy link
Copy Markdown
Member

Description

Improves the efficiency of project metrics updates by calculating metrics of all components of a project in bulk, rather than calling the UPDATE_COMPONENT_METRICS stored proc in a loop. Adds a new COMPUTE_COMPONENT_METRICS function so the functionality can be shared between metrics updates of full projects, and of individual components.

Also significantly reduces I/O overhead by being smarter about when to write new metrics rows. Most notably, this change skips row creation if another row with identical metrics values already exists for the same day.

Addressed Issue

Relates to #6642

Metrics updates showed up as main contributor to DB / system load there.

Additional Details

Note that this means that the LAST_OCCURRENCE column can no longer be used to judge metrics freshness within a day. Since as of v5, metrics aggregations have day-resolution, intra-day data points with identical values provide no value there. LAST_OCCURRENCE still advances at least once per day, since the first update of a day always inserts. Only intra-day resolution is lost, and nothing (we know of) relies on it. The I/O savings outweigh keeping the legacy behavior in any case.

For a large project with 9k components in a test instance, runtime of UPDATE_PROJECT_METRICS dropped from ~3.5s to ~300ms. In the ideal case (successive runs on the same day without metrics changes), the previous implementation caused 3MB of WAL writes, where the new implementation causes single-digit kB writes.

Checklist

  • I have read and understand the contributing guidelines
  • This PR fixes a defect, and I have provided tests to verify that the fix is effective
  • This PR implements an enhancement, and I have provided tests to verify that it works as intended
  • This PR introduces changes to the database model, and I have updated the migration changelog accordingly
  • This PR introduces new or alters existing behavior, and I have updated the documentation accordingly
  • This PR is a substantial change (per the ADR criteria), and I have added an ADR under docs/adr/

@nscuro nscuro added this to the 5.1 milestone Jul 12, 2026
@nscuro nscuro added enhancement New feature or request performance labels Jul 12, 2026
@owasp-dt-bot

owasp-dt-bot commented Jul 12, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@codacy-production

codacy-production Bot commented Jul 12, 2026

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · +0.11% coverage variation

Metric Results
Coverage variation +0.11% coverage variation (-1.00%)
Diff coverage diff coverage (70.00%)

View coverage diff in Codacy

Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (341c917) 42816 37138 86.74%
Head commit (d4c7216) 42816 (+0) 37187 (+49) 86.85% (+0.11%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#6655) 0 0 ∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

Improves the efficiency of project metrics updates by calculating metrics of all components of a project in bulk, rather than calling the `UPDATE_COMPONENT_METRICS` stored proc in a loop. Adds a new `COMPUTE_COMPONENT_METRICS` function so the functionality can be shared between metrics updates of full projects, and of individual components.

Also significantly reduces I/O overhead by being smarter about when to write new metrics rows. Most notably, this change skips row creation if another row with identical metrics values already exists *for the same day*.

Note that this means that the `LAST_OCCURRENCE` column can no longer be used to judge metrics freshness *within a day*. Since as of v5, metrics aggregations have day-resolution, intra-day data points with identical values provide no value there. `LAST_OCCURRENCE` still advances at least once per day, since the first update of a day always inserts. Only intra-day resolution is lost, and nothing (we know of) relies on it. The I/O savings outweigh keeping the legacy behavior in any case.

For a large project with 9k components in a test instance, runtime of `UPDATE_PROJECT_METRICS` dropped from ~3.5s to ~300ms. In the ideal case (successive runs on the same day without metrics changes), the previous implementation caused 3MB of WAL writes, where the new implementation causes single-digit kB writes.

Signed-off-by: nscuro <nscuro@protonmail.com>
@nscuro nscuro force-pushed the reduce-project-metrics-update-io-cost branch from ae8294c to d4c7216 Compare July 12, 2026 21:37
@nscuro nscuro merged commit 2e83639 into DependencyTrack:main Jul 12, 2026
18 checks passed
@nscuro nscuro deleted the reduce-project-metrics-update-io-cost branch July 12, 2026 21:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request performance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants