From 696f3e311da447f701f4c2885961b24ec690fe6f Mon Sep 17 00:00:00 2001 From: Maximilian Grimm Date: Thu, 17 Sep 2026 11:17:54 +0200 Subject: [PATCH] Episode 13: settled RAM figure for the tuned CRS --- crowdsec/README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/crowdsec/README.md b/crowdsec/README.md index c1fba29..a78b705 100644 --- a/crowdsec/README.md +++ b/crowdsec/README.md @@ -181,8 +181,7 @@ probes blocked on the non-excluded routes. The cost is precise: on an excluded route (say the Forgejo API) generic SQLi/XSS now passes to the app, while virtual patching still catches known CVEs there, and on a non-excluded host (vault, status) the full CRS applies. Latency added over vpatch: about +2 ms -time-to-first-byte per request. RAM: see the episode notes; CRS settles around -the same order as vpatch once loaded, roughly +15 to 40 MB. +time-to-first-byte per request. RAM measured settled: +9 MB over vpatch after five minutes (vpatch ~184 MB, CRS+exclusions ~193 MB). The ~25-45 MB people cite is a load-time peak, not the steady cost. Traps found while tuning: - `RemoveInBandRuleByName("crowdsecurity/crs")` in a `pre_eval` hook does **not**