Time-consuming Agents section

[Desvelao]

Wazuh	Elastic	Rev	Security
4.3.x	7.x	4xxx	Basic, ODFE, Xpack

Description The Agents section for the app can take too much time to load and render some elements. This is due to the requests related to Elasticsearch when the selected app time filter involves numerous documents or the Elasticsearch response is slow. The Agents section should be fast because it is frequently visited.

Tasks

• [ ] Research about how to enhance the performance. Some possible solutions:
  • Limit the time filter range to a specific value and doesn't depend on the app selected time filter
  • Move the related UI elements to another view (Evolution visualization and Most agent active stat)
  • Add a time picker
• [ ] Apply the better solution

Acceptance criteria

• The view should be fast and not be affected by environments with numerous documents in its indices.

[asteriscos]

Initial analysis

Environment

The initial test was made in a local environment with 110k agents

Sitespeed Watefall

Analysis

In this first approach we detected that the most time consuming requests were made to Wazuh API in agent related endpoints, such as:

• /agents/summary/status
• /agents
• /agents/000/config/auth/auth
• /agents/000/config/request/remote

These requests are made by:

• agents-preview controller This request can be avoided by updating the agentsPreview controller props when the child component makes the exact same request. This way we can avoid an expensive duplicate request. https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/controllers/agent/agents-preview.js#L80 Avoid making the request

Update the properties with the child results

• agents-table component

These 3 requests were created to allow selecting agents from the table and delete or upgrade them, but even though most of the feature is developed it is not fully implemented. The best approach in this case is to delete all unused code, even more if it has requests. https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/controllers/agent/components/agents-table.js#L169 https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/controllers/agent/components/agents-table.js#L170 https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/controllers/agent/components/agents-table.js#L171

const managerVersion = await WzRequest.apiReq('GET', '/', {});
const totalAgent = await WzRequest.apiReq('GET', '/agents', {});
const agentActive = await WzRequest.apiReq('GET', '/agents/summary/status', {});

https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/controllers/agent/components/agents-table.js#L232

• agents-preview component

https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/controllers/agent/components/agents-preview.js#L113 https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/controllers/agent/components/agents-preview.js#L115

• register-agent component

https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/controllers/agent/components/register-agent.js#L213 https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/controllers/agent/components/register-agent.js#L223

In this analysis we observed the register-agent component is loading as soon as the agents-preview controller initializes, but this component should be rendered only if the user clicks on Deploy Agent wizard button. This can be easily fixed by changing the ng-show to ng-if when the agent deployment wizard is active:

https://github.com/wazuh/wazuh-kibana-app/blob/v4.3.6-7.10.2/public/templates/agents-prev/agents-prev.html#L39

<div class="registerAgent" ng-show="ctrl.addingNewAgent">
      <react-component name="RegisterAgent" props="ctrl.registerAgentsProps"></react-component>
</div>

The analysis of this section is still in progress.

[AlexRuiz7]

Performance comparative is in the PR

[asteriscos]

Fix strategy

The strategy used in the issue Agents section performance improvements #4363 is to:

• Reduce the number of requests to Wazuh API
• Use the same request to feed all the components that require the information
• Load widgets requests in parallel asynchronously whenever possible (avoid sequential requests)
• Replace the top big loading icon with 3 independent loading indicators to be able to show data as soon as it is available (Related with the previous point)

Pending issue:

• [ ] #4388