bneradt opened a new pull request, #13819: URL: https://github.com/apache/trafficserver/pull/13819
The abuse_shield maintenance task pruned rule buckets for every tracked IP once per second. Each pass snapshots all three trackers under their table locks, then locks every entry to erase buckets for rules that are no longer configured. With 100k slots per tracker this cost about 0.9% of ATS CPU on production hosts, and between reloads it never found anything to remove. Obsolete buckets only appear after a configuration reload, either left behind by the reload or recreated by a hook still holding the pre-reload configuration for the rest of its callback. This patch addresses this by pruning on reload and then for only the next five maintenance passes, which covers that window with a wide margin. Tracker stats continue to sync every second. Pruning now reports how many buckets it removed, and the final post-reload pass logs a warning if it still removes any. Debt replenishment already keeps such a bucket from pinning its tracker slot, but finding one would mean a hook held the old configuration longer than this window assumes. Co-Authored-By: Claude Opus 5.5 Medium <[email protected]> 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
