Micrometer 404s can be abused to trigger an out of memory
- Dominant language
- Kotlin
- Stars
- 14.5k
- Forks
- 1.3k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 49
Description
With Micrometer, each timer is written to memory and retained. This means it could be a sort of memory leak, so you need to constrain the tag cardinality. (A good rule of thumb is 100 per metric)
If a ktor application with Micrometer is hit and triggers a 404, it creates a new metric for the new url. This can cause memory usage to climb until the application runs out of memory.
A meter filter can fix it as a work around (unifying all 404 request as a `404` route tag):
```kotlin
class Filter404: MeterFilter {
override fun map(id: Meter.Id): Meter.Id {
if(id.name == "ktor.http.server.requests" && id.getTag("status") == "404") {
return id.withTag(Tag.of("route", "404"));
}
return id;
}
}
```
Add it to the registry being used:
```kotlin
val appMicrometerRegistry = SimpleMeterRegistry().apply {
config().meterFilter(Filter404())
}
```
However, it would be great to proactively group all 404 meters into the tag., so others don't need to encounter this. Would a PR with that functionality be worthwhile?
Contributor guide
Research direction
Start by locating the Ktor Micrometer integration that creates HTTP request meters and handles 404 route tags; the issue does not name a file or test. Compare its behavior with the Filter404 workaround, then add coverage showing that requests producing different 404 URLs share one route tag and do not create unbounded meters.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- observability
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100