CERT-Polska
Allow time-limiting queries
Feature Category
- [ ] Correctness
- [X] User Interface / User Experience
- [X] Performance
- [ ] Other (please explain)
Describe the problem
I would like to be able to timelimit queries and control the value as part of a configuration in the Config tag. There are quite a lot of cases in which the query can be extremely inefficient, and thus run for several days on a really big dataset.
Describe the solution you'd like
According to 23, there would be at least two permission levels. For each such level, we should have an option to configure the time limit for the query. Each query passing this limit will be canceled.
Describe alternatives you've considered
For each query checking how wasteful he is, and stop it manually if needed. Doesn't work on a large number of users who aren't aware of the constraints.
Sounds very reasonable and it's certainly something that I'd like to have.
Two things:
What do you think about limits based on consumed resources (number of files checked by yara, for example)? This may give more predictible results (execution time depends on the query, but also the overall load of the system). It will also give a faster feedback for the user (they will know that the query is going to be limited as soon as ursadb returns).
There is no way to interrupt ursadb query, so very short limits like "1 second" won't work well (ursadb will finish the query anyway). Queries are now sharded by datasets and don't take extremely long, so this shouldn't be a huge problem.
The most time-consuming part is the yara scanning, so limiting this part will work as well, and indeed be more predictable. So your suggestion will work as well.