Skip to content

ROX-35259: reduce formatProcess allocs in risk scoring#21353

Draft
ebensh wants to merge 1 commit into
ebenshet/rox-35259-reduce-risk-reprocessing-allocs-startup-checkfrom
ebenshet/rox-35259-reduce-risk-reprocessing-allocs-format-process
Draft

ROX-35259: reduce formatProcess allocs in risk scoring#21353
ebensh wants to merge 1 commit into
ebenshet/rox-35259-reduce-risk-reprocessing-allocs-startup-checkfrom
ebenshet/rox-35259-reduce-risk-reprocessing-allocs-format-process

Conversation

@ebensh

@ebensh ebensh commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Description

Stacked on #21352.

formatProcess uses stringutils.WriteStringf (which calls fmt.Sprintf internally)
with the %q verb for every violating process indicator. The fmt machinery, quoted-string
formatting, and strings.Builder growth account for ~171M heap allocations per
reprocessing cycle in production profiles.

Fix: pre-size the strings.Builder to 128 bytes and use strconv.Quote +
direct WriteString calls instead of the fmt-based path. Output is identical
(%q and strconv.Quote produce the same Go-quoted string).

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

  • Existing unit tests in central/risk/multipliers/deployment pass
  • strconv.Quote produces identical output to %q — both use Go quoted-string format
  • Identified via pprof alloc_objects profile of Central under steady-state load (1.35h capture)

🤖 Generated with Claude Code

Pre-size strings.Builder and replace stringutils.WriteStringf (which uses
fmt.Sprintf + %%q) with direct WriteString + strconv.Quote. Eliminates
~171M heap allocations per reprocessing cycle from fmt machinery and
builder growth.
@openshift-ci

openshift-ci Bot commented Jun 23, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@coderabbitai

coderabbitai Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: ec4fe364-22f0-4f58-ae72-65bf8d4fcfb7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch ebenshet/rox-35259-reduce-risk-reprocessing-allocs-format-process

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown
Contributor

🚀 Build Images Ready

Images are ready for commit ac32438. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.12.x-269-gac32438390

Comment on lines 60 to +61
sb := strings.Builder{}
stringutils.WriteStringf(&sb, "Detected execution of suspicious process %q", process.SignalName)
sb.Grow(128)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why 128? The strings are likely to be longer with signalname and signalargs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant