Tip: Memory limits when developing apps

One of the challenges we ran into when developing apps was the memory limit on the docker containers in the App Framework. As you develop your apps, it pays to think about how you write your code to keep your memory foot small.

Recommendations:

• Limit the number of imports that you use.

  Instead of blanket importing everything in a library, import the individual methods you need out of that library.

• Keep your internal structures small. Don’t create a loop that builds an array with hundreds or thousands of elements. Instead, do what needs to be done to each element inside the loop.
• Use the sqlite3 database to store information, instead of storing it in an internal memory structure.

You can monitor your memory usage by doing the following:

1. Using SSH, log in to the QRadar Console as the root user.
2. Type: docker ps
3. Get the docker container id for your app. You have to guess a little bit here, I use the “CREATED” as a tip for which container I may be interested in.
4. Type: docker stats [Your_app_container_id]

   Results
   You will see a column with MEM %. When this value approaches 100% you need to start thinking about optimizing your app.