microsoft
feat: LRU cache for flows in `packetparser`
Description
This PR optimizes the packetparser plugin by introducing an LRU cache to reduce memory and CPU usage under heavy traffic. Instead of generating a new Flow object for each packet event, the cache stores Flow objects based on source/destination IPs, ports, protocol, and direction. Packet events with matching values will reuse the existing Flow object, preventing excessive ToFlow invocations and potential OOM kills for the agent.
Related Issue
If this pull request is related to any issue, please mention it here. Additionally, make sure that the issue is assigned to you before submitting this pull request.
Checklist
- [x] I have read the contributing documentation.
- [x] I signed and signed-off the commits (
git commit -S -s ...). See this documentation on signing commits. - [x] I have correctly attributed the author(s) of the code.
- [x] I have tested the changes locally.
- [x] I have followed the project's style guidelines.
- [ ] I have updated the documentation, if necessary.
- [ ] I have added tests, if applicable.
Screenshots (if applicable) or Testing Completed
Over a similar period of time under the same workload, the total memory allocation for ToFlow without cache
vs with cache
Please add any relevant screenshots or GIFs to showcase the changes made.
Additional Notes
Add any additional notes or context about the pull request here.
Please refer to the CONTRIBUTING.md file for more information on how to contribute to this project.
