You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "bneradt (via GitHub)" <gi...@apache.org> on 2026/10/08 18:41:06 UTC
[PR] abuse_shield: address pruning cpu load [trafficserver]
bneradt opened a new pull request, #13819:
URL: https://github.com/apache/trafficserver/pull/13819
The abuse_shield maintenance task pruned rule buckets for every tracked
IP once per second. Each pass snapshots all three trackers under their
table locks, then locks every entry to erase buckets for rules that are
no longer configured. With 100k slots per tracker this cost about 0.9%
of ATS CPU on production hosts, and between reloads it never found
anything to remove.
Obsolete buckets only appear after a configuration reload, either left
behind by the reload or recreated by a hook still holding the
pre-reload configuration for the rest of its callback. This patch
addresses this by pruning on reload and then for only the next five
maintenance passes, which covers that window with a wide margin.
Tracker stats continue to sync every second.
Pruning now reports how many buckets it removed, and the final
post-reload pass logs a warning if it still removes any. Debt
replenishment already keeps such a bucket from pinning its tracker
slot, but finding one would mean a hook held the old configuration
longer than this window assumes.
Co-Authored-By: Claude Opus 5.5 Medium <no...@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] abuse_shield: address pruning cpu load [trafficserver]
Posted by "bneradt (via GitHub)" <gi...@apache.org>.
bneradt merged PR #13819:
URL: https://github.com/apache/trafficserver/pull/13819
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org