ktorio / ktorio/ktor

Micrometer 404s can be abused to trigger an out of memory

Open
#4,722 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Kotlin
Stars
14.5k
Forks
1.3k
Avg merge
2d 13h
Merged PRs (30d)
49

Description

With Micrometer, each timer is written to memory and retained. This means it could be a sort of memory leak, so you need to constrain the tag cardinality. (A good rule of thumb is 100 per metric)

If a ktor application with Micrometer is hit and triggers a 404, it creates a new metric for the new url. This can cause memory usage to climb until the application runs out of memory.

A meter filter can fix it as a work around (unifying all 404 request as a `404` route tag):

```kotlin
class Filter404: MeterFilter {
override fun map(id: Meter.Id): Meter.Id {
if(id.name == "ktor.http.server.requests" && id.getTag("status") == "404") {
return id.withTag(Tag.of("route", "404"));
}
return id;
}
}
```
Add it to the registry being used:
```kotlin
val appMicrometerRegistry = SimpleMeterRegistry().apply {
config().meterFilter(Filter404())
}
```

However, it would be great to proactively group all 404 meters into the tag., so others don't need to encounter this. Would a PR with that functionality be worthwhile?

Contributor guide

Open the contributing guide

Research direction

Start by locating the Ktor Micrometer integration that creates HTTP request meters and handles 404 route tags; the issue does not name a file or test. Compare its behavior with the Filter404 workaround, then add coverage showing that requests producing different 404 URLs share one route tag and do not create unbounded meters.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
observability
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.