High RAM uses

[MiteshShah]

Hello All,

I'd built launchpad package six month ago which run just fine.
But when last week we build ModSec 3.0.4 + 1.0.1 (this repo) and 3.04 + master repo which had #175 (works fine for custom error pages) but both of this build had HIGH RAM uses.

NGINX without Modsec take nearly 14MB and as soon as we enable with single vhost its 300MB and if we put 5 vhost its used nearly 500 to 700MB

Also if we disable modsec and restart nginx RAM uses drop to 15MB.

How to test

sudo add-apt-repository ppa:miteshshah/nginx
sudo add-apt-repository ppa:miteshshah/modsecurity
sudo apt-get update
sudo apt-get install nginx libnginx-mod-http-modsecurity

[zimmerle]

Hi @MiteshShah

This memory usage happens immediately after start? or it is something that grows over time?

[MiteshShah]

Yup immediately RAM uses goes up and if we disable WAF and restart nginx again drop to 14 to 20 MB

[zimmerle]

How you are loading the rules into the vhosts? Is it a single global configuration or you are loading one by one?

[MiteshShah]

Each vhost include production.conf file

server {
server_name xyz.com;
....
....
  include /etc/nginx/snippets/production.conf;
}

And inside production.conf we include modsec.conf

cat  /etc/nginx/snippets/production.conf;
# PHP files
location ~ \.php$ {

  #including Modsecurity conf files
  include /etc/nginx/modsec/modsec.conf;
}

cat /etc/nginx/modsec/modsec.conf 
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;

cat /etc/nginx/modsec/main.conf 
# From https://github.com/SpiderLabs/ModSecurity/blob/master/
# modsecurity.conf-recommended
#
# Edit to set SecRuleEngine On
Include "/etc/nginx/modsec/modsecurity.conf"
Include "/etc/nginx/modsec/removed-rules.conf"
Include "/etc/nginx/modsec/waf/rules.conf"

[zimmerle]

In that fashion, you are loading a copy of all the rules for each vhost. I would recommend loading the rules on the main config, adding only specificities in the context of each vhost.

[rahulbhatu]

Hi @zimmerle ,

we have kept rules in /etc/nginx/modsec/waf/ directory the rules.conf file has all the rules we use. so that looks like global configuration file rules.conf for that vhost.

[zimmerle]

Indeed, that is a global configuration for a vhost, as you have many of them there will be a copy of the loaded rules for each. Instead, you can load the rules below the vhost configuration.

[MiteshShah]

That helps :)
Thank you @zimmerle