You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
url label contains the url of every request that was ever made against gin webserver. This can cause very high memory usage for prometheus server. What's worse this is out of control for the operator of a service running go-gin-prometheus and someone sending a high number of requests with random url can easily cause prometheus server scraping that webserver to run out of memory. This is a common misuse of prometheus metrics and there's even a tool written to detect and mitigate the most serious cases of cardinality explosion - https://blog.freshtracks.io/bomb-squad-automatic-detection-and-suppression-of-prometheus-cardinality-explosions-62ca8e02fa32
This was already reported in #34 and partially fixed in #35 but those changes are not enough.
All metrics already have the handler label that points to the request handler method that the request was routed to, this is enough to identify requests for any debugging / performance tracking.
Please remove the url label from metrics.
The text was updated successfully, but these errors were encountered:
Another option might be to use c.FullPath() rather than c.Request.URL.Path for the url label. FullPath was recently added in gin v1.5.0 and returns the path from the matched route or empty string for not found. So cardinality should be limited to the number of routes you have.
url
label contains the url of every request that was ever made against gin webserver. This can cause very high memory usage for prometheus server. What's worse this is out of control for the operator of a service running go-gin-prometheus and someone sending a high number of requests with random url can easily cause prometheus server scraping that webserver to run out of memory. This is a common misuse of prometheus metrics and there's even a tool written to detect and mitigate the most serious cases of cardinality explosion - https://blog.freshtracks.io/bomb-squad-automatic-detection-and-suppression-of-prometheus-cardinality-explosions-62ca8e02fa32This is very easy to reproduce with curl:
Resulting in:
This was already reported in #34 and partially fixed in #35 but those changes are not enough.
All metrics already have the
handler
label that points to the request handler method that the request was routed to, this is enough to identify requests for any debugging / performance tracking.Please remove the
url
label from metrics.The text was updated successfully, but these errors were encountered: