selfhostedops/selfhostedops-stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Episode 13: settled RAM figure for the tuned CRS

Browse source
This commit is contained in:
Maximilian Grimm 2026-09-17 11:17:54 +02:00
parent 22300d7a28
commit 696f3e311d
1 changed files with 1 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
crowdsec/README.md
View file

@ -181,8 +181,7 @@ probes blocked on the non-excluded routes. The cost is precise: on an excluded
route (say the Forgejo API) generic SQLi/XSS now passes to the app, while
virtual patching still catches known CVEs there, and on a non-excluded host
(vault, status) the full CRS applies. Latency added over vpatch: about +2 ms
time-to-first-byte per request. RAM: see the episode notes; CRS settles around
the same order as vpatch once loaded, roughly +15 to 40 MB.
time-to-first-byte per request. RAM measured settled: +9 MB over vpatch after five minutes (vpatch ~184 MB, CRS+exclusions ~193 MB). The ~25-45 MB people cite is a load-time peak, not the steady cost.
Traps found while tuning:
- `RemoveInBandRuleByName("crowdsecurity/crs")` in a `pre_eval` hook does **not**