Added pprof profiling to monitor heap memory#318
Conversation
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
cmd/service/metro/metro.go
Outdated
| logger.Ctx(ctx).Infow("initialising pprof profiles") | ||
| go func() { | ||
| if componentName == Web { | ||
| http.ListenAndServe("metro-web-pprof.concierge.stage.razorpay.in:8080", nil) |
There was a problem hiding this comment.
Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
🔴 Fix or ignore this finding to merge your pull request.🙈 From go.lang.security.audit.net.use-tls.use-tls.
cmd/service/metro/metro.go
Outdated
| if componentName == Web { | ||
| http.ListenAndServe("metro-web-pprof.concierge.stage.razorpay.in:8080", nil) | ||
| } else if componentName == Worker { | ||
| http.ListenAndServe("metro-worker-pprof.concierge.stage.razorpay.in:8080", nil) |
There was a problem hiding this comment.
The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use import "net/http/pprof". See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.
🔴 Fix or ignore this finding to merge your pull request.🙈 From go.lang.security.audit.net.pprof.pprof-debug-exposure.
cmd/service/metro/metro.go
Outdated
| if componentName == Web { | ||
| http.ListenAndServe("metro-web-pprof.concierge.stage.razorpay.in:8080", nil) | ||
| } else if componentName == Worker { | ||
| http.ListenAndServe("metro-worker-pprof.concierge.stage.razorpay.in:8080", nil) |
There was a problem hiding this comment.
Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
🔴 Fix or ignore this finding to merge your pull request.🙈 From go.lang.security.audit.net.use-tls.use-tls.
cmd/service/metro/metro.go
Outdated
| logger.Ctx(ctx).Infow("initialising pprof profiles") | ||
| go func() { | ||
| if componentName == Web { | ||
| http.ListenAndServe("metro-web-pprof.concierge.stage.razorpay.in:8080", nil) |
There was a problem hiding this comment.
The profiling 'pprof' endpoint is automatically exposed on /debug/pprof. This could leak information about the server. Instead, use import "net/http/pprof". See https://www.farsightsecurity.com/blog/txt-record/go-remote-profiling-20161028/ for more information and mitigation.
🔴 Fix or ignore this finding to merge your pull request.🙈 From go.lang.security.audit.net.pprof.pprof-debug-exposure.
| logger.Ctx(ctx).Infow("initialising pprof profiles") | ||
| go func() { | ||
| myMux := http.DefaultServeMux | ||
| if err := http.ListenAndServe("localhost:8080", myMux); err != nil { |
There was a problem hiding this comment.
Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
🔴 Fix or ignore this finding to merge your pull request.🙈 From go.lang.security.audit.net.use-tls.use-tls.
Codecov Report
@@ Coverage Diff @@
## master #318 +/- ##
==========================================
- Coverage 59.28% 59.26% -0.03%
==========================================
Files 124 124
Lines 9506 9506
==========================================
- Hits 5636 5634 -2
- Misses 3515 3516 +1
- Partials 355 356 +1
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| "net/http" | ||
|
|
||
| // blank import added for testing. | ||
| _ "net/http/pprof" |
There was a problem hiding this comment.
🚫 [golangci] reported by reviewdog 🐶
G108: Profiling endpoint is automatically exposed on /debug/pprof (gosec)
| logger.Ctx(ctx).Infow("stopped metro") | ||
| } | ||
|
|
||
| // sets up pprof profile for perfomance monitoring |
There was a problem hiding this comment.
🚫 [golangci] reported by reviewdog 🐶perfomance is a misspelling of performance (misspell)
|
|
||
| // sets up pprof profile for perfomance monitoring | ||
| func setPprofProfiles(ctx context.Context, componentName string) { | ||
| logger.Ctx(ctx).Infow("initialising pprof profiles") |
There was a problem hiding this comment.
🚫 [golangci] reported by reviewdog 🐶initialising is a misspelling of initializing (misspell)
4 participants
No description provided.