Skip to content

Keep per-event threat context queries to their time windows - #19

Open
macjayz wants to merge 1 commit into
mainfrom
perf/bounded-threat-context
Open

macjayz wants to merge 1 commit into
mainfrom
perf/bounded-threat-context

Conversation

@macjayz

@macjayz macjayz commented Nov 1, 2026

Copy link
Copy Markdown
Owner

The worker runs the threat context queries for every evm_rpc event. Three of them filtered by time only inside count(*) filter, so each read the endpoint's or provider's whole history. The endpoint match used is not distinct from, which no index can serve. On the study database (650k events) this pinned Postgres at ~650% CPU, and the worker fell behind the stream and stopped saving events.

  • Bound the wallet, provider and throttling queries to their 24/25-hour windows. Every filter clause already sat inside those windows, so the results are unchanged.
  • Compare a known endpoint hash with =. A null hash still matches only nulls.
  • Migration 004_threat_context_indexes.sql: indexes for the provider and wallet lookups.

Throttling query for one endpoint on the study DB: 1211 ms (parallel seq scan) down to 153 ms (index scan).

Tests: npm test -w apps/worker with HEIGHTPROOF_INTEGRATION=1 against disposable Postgres and Redis: 81/81 pass.

The worker runs these for every evm_rpc event. Three of them filtered by time only inside
count(*) filter, so each read the endpoint's or provider's whole history, and the endpoint
match used is not distinct from, which no index can serve. On the study database (650k rows)
the worker fell behind the stream and stopped saving events.

Bound the queries to their windows, compare a known endpoint hash with =, and index provider
and wallet lookups. Results are unchanged.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant