Alertmanager · English · Why does alertmanager-en use twice the memory of comparable tools?

949
ALr/alertmanager-en·posted by slow_query·yesterdayOpen source

Why does alertmanager-en use twice the memory of comparable tools?

Some background first. Our setup is alertmanager-en plus three downstream services, seven figures of daily requests, peaking around nine in the evening.

We also fixed monitoring along the way: replaced average-based alerts with percentiles and split them per endpoint. False alerts dropped by about seventy percent and the on-call rotation visibly cheered up.

Keep it and wait for an official fix44%
Switch to a third-party option now28%
Fork and maintain it ourselves17%
Write an adapter layer and wait11%

1613 votes total

350 comments

350 comments

· first 120 loaded
M
Cchen_dev·1 hour ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

451
Kkite·2 days ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

444
Kkite·2 days ago

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

405
Rran_bo·2 days ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

393
Sslow_query·28 minutes ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

385
Rrase·2 days ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

356
Ddev_zhou·2 days ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

272
Ttang_hao·2 days ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

33
Hhuang_keMod·2 days ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

133
Zzhu_zong·5 hours ago

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

28
Bbob_chen·2 days ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

119
Sswoole_lee·1 hour ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

338
Mmike_xu·2 days ago

This is not a alertmanager-en problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

322
Cchen_dev·2 days agoedited

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

318
Sswoole_lee·2 days ago

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

313
Rrase·2 days ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

286
Rrase·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

263
Mmike_xu·5 hours ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

234
Oops_wang·2 days ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

230
Rrase·2 days agoedited

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

219
Sslow_query·2 days ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

214
Wwinter·1 hour ago

I just read the alertmanager-en source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

205
Nnikic·2 days ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

184
Rran_bo·2 days ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

54
Oops_wang·2 days ago

One counter-example: below alertmanager-en 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

37
Ttang_hao·2 days ago

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

40
Kkite·2 days ago

I just read the alertmanager-en source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

152
Rrase·12 minutes ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

146
Rran_bo·2 days ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

142
Zzhou_yi·yesterday

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

118
Wwinter·2 days ago

I just read the alertmanager-en source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

117
Zzhu_zong·2 days ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

96
Hhuang_keOP·just now

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

35
Hhuang_ke·2 days ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

87
Kkite·1 hour ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

82
Ttang_haoOP·just now

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

19
Kkernel_panic·3 minutes ago

This is not a alertmanager-en problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

398
Zzhou_yi·12 minutes ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

389
Hhuang_ke·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

94
Ttang_haoMod·2 days ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

173
Zzhou_yiOP·2 days ago

This is not a alertmanager-en problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

94
Zzhou_yi·2 days agoedited

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

129
Oops_wang·12 minutes ago

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

53
Mmike_xu·2 days ago

One counter-example: below alertmanager-en 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

2
Wwinter·2 days agoLevel 6

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

1
Oops_wang·12 minutes ago

One counter-example: below alertmanager-en 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

1
Hhuang_keMod·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

473
Sswoole_lee·2 days agoedited

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

170
Ddev_zhouMod·1 hour ago

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

96
KkiteOP·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

499
Ddev_zhou·2 days ago

I just read the alertmanager-en source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

63
Kkite·2 days agoLevel 6

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

13
Rrase·2 days agoedited

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

22
Ddev_zhou·2 days agoLevel 6

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

162
Lli_ming·2 days ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

274
Mmike_xuOP·12 minutes ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

329
Sslow_query·2 days agoLevel 6

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

391
Zzhou_yi·2 days agoLevel 6

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

275
Wwinter·2 days agoeditedLevel 6

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

235
Oops_wang·12 minutes agoLevel 6

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

169
Oops_wang·2 days agoLevel 6

I just read the alertmanager-en source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

4
Oops_wang·5 hours ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

11
Rran_bo·just nowLevel 6

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

21
Sslow_query·2 days ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

8
Ttang_hao·2 days agoLevel 6

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

114
Hhuang_ke·2 days ago

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

6
Sslow_queryOPMod·2 days agoeditedLevel 6

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

441
Llinlin·2 days agoLevel 6

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

3
Sswoole_leeMod·3 minutes agoedited

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

188
Hhuang_ke·2 hours ago

One counter-example: below alertmanager-en 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

507
Mmike_xu·2 days agoLevel 6

Saved. I am reworking this area this week — this saves a lot of wrong turns.

446
Zzhou_yi·3 minutes agoLevel 6

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

20
Aalice_dev·1 hour ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

54
Mmike_xu·just now

I just read the alertmanager-en source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

88
Wwinter·2 days ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

124
Rrase·2 days ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

225
Bbob_chen·2 days agoLevel 6

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

10
Zzhou_yi·2 hours ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

22
Llinlin·2 days ago

This is not a alertmanager-en problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

7
Sswoole_leeOP·2 days agoedited

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

139
Hhuang_ke·2 hours ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

276
Bbob_chenMod·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

5
Kkite·2 days agoedited

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

419
Ttang_hao·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

203
Rrase·2 days ago

One counter-example: below alertmanager-en 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

125
Ddev_zhou·2 days ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

61
Mmike_xu·3 minutes ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

222
Oops_wang·2 days agoedited

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

125
Cchen_dev·2 days ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

53
Wwinter·2 days ago

One counter-example: below alertmanager-en 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

40
Mmike_xu·2 days agoedited

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

1
Mmike_xu·2 days ago

One counter-example: below alertmanager-en 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

78
Kkite·2 days ago

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

60
Oops_wangOP·1 hour ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

11
NnikicMod·2 hours ago

This is not a alertmanager-en problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

55
Wwinter·2 days ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

52
Sslow_query·2 days ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

51
Ttang_hao·2 days ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

18
Zzhou_yiOP·12 minutes ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

160
Aalice_dev·2 days ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

49
Sslow_query·12 minutes ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

45
Bbob_chen·2 days ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

4
Rran_bo·2 days agoedited

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

11
Cchen_dev·2 days ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

240
Llinlin·2 days agoedited

This is not a alertmanager-en problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

149
Lli_ming·28 minutes ago

This is not a alertmanager-en problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

42
Ddev_zhou·2 days ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

40
Bbob_chen·2 days ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

28
Ddev_zhou·2 days ago

This is not a alertmanager-en problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

20
Oops_wang·2 days ago

One counter-example: below alertmanager-en 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

16
Llinlin·3 minutes ago

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

9
Llinlin·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

5
Cchen_devMod·yesterday

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

5
Cchen_dev·2 hours ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

4
Kkite·2 days ago

I just read the alertmanager-en source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

3
Sswoole_lee·2 days ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

3
Zzhou_yi·2 days ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

359
Oops_wang·2 days ago

I just read the alertmanager-en source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

1
Kkite·2 days ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

292
Kkite·2 hours ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

1

This is the post detail page /en/c/alertmanager-en/post/p10. Posts and comments are generated deterministically from a seeded PRNG, so the same post always renders the same content and the link can be shared, reloaded and indexed. In production this page reads MySQL for the post, Redis for hot-post caching, and fetches the whole comment tree in a single query on the path column.

See the database schema →