Reduce memory accumulation for long-running scans#1017
Merged
Conversation
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
eslerm
approved these changes
Jun 27, 2025
Contributor
eslerm
left a comment
There was a problem hiding this comment.
VM with 512GB of RAM and did not OOM or panic once
🤯
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is a targeted attempt at mitigating an edge-case where long-running scans of millions of files will eventually OOM a system if only the top-level directory is provided as a scan path.
This isn't an all-encompassing or holistic fix but helps quite a bit and there are still improvements such as streaming paths/results which we can make if this is not sufficient.
The main improvements are the usage of channels/pinning instead of a
sync.Poolfor the scanners which are relatively volatile (at high levels of concurrency, thesync.PoolGC would make them panic, for instance) along with leveraging file descriptors for scanning files.go-yarasupported this natively, but we have to get a bit creative with yara-x if we want to avoid reading every single file into memory viaio.ReadAllor the current implementation. The downside is that we still need the file's contents to calculate its hash and pull out the match strings. If necessary, these can be optimized in a future PR.I ran several scans of ~14 million files each on a VM with 512GB of RAM and did not OOM or panic once, though I did cap out at about ~410GB of memory usage. If all else fails, we can drop the scanner pool and run single-use scanners via
yrs.Scanwhich is much slower because of the scanner creation/destruction overhead but also has relatively little memory impact.