Uploaded image for project: 'Red Hat Advanced Cluster Security'
  1. Red Hat Advanced Cluster Security
  2. ROX-29613

Entities/flows are re-inserted in DB some time after pruning

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • 4.8.1
    • 4.8.0
    • Central, Sensor
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • False

      USER PROBLEM
      The database ends-up containing stale data that the user cannot access. This data is not reclaimed and it results in lost space and possibly to exhaustion.

      CONDITIONS
      A POD with recent flows is destroyed.

      We observe that the flows (and discovered entities) are removed from the database. Later, some of the flows and entities get inserted back.

      ROOT CAUSE
      Only speculation for the moment : it looks like, while the deployment is already deleted, flows/entities continue to be sent by Sensor for this deployment, and Central stores them.

      FIX

      Prevent Sensor/Central from sending information about already deleted deployments ?

      REPRODUCTION

      I observed the described issue with the following scenario:

      1. create a lot of flows with one POD and 32K external entities
        I used legions to generate outgoing connections to 223.42.0.2-223.42.128.1 all with the same port.
      2. observed 32K external entities in the DB
        Issued a query to select/count all entities with discovered=true
      3. delete the deployment
      4. after a moment, everything gets flushed and central memory drops considerably
        kubectl top pod / rerun the SQL query regularly
      5. some entities get inserted back. In this test, I got 12K back

              jvirtane@redhat.com Jouko Virtanen
              rh-ee-ovalenti Olivier Valentin
              ACS Collector
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: