Hi everyone. I'm fairly new to Checkmarx (running version 1.x) and have been tasked with getting it integrated into our CI pipeline for a monolithic Java application. I’ve hit a wall that’s blocking our rollout.
The scan engine consistently crashes about 20-30 minutes into a scan of our main codebase. The error logs aren't super helpful—usually just a generic out-of-memory Java exception or a sudden stop with a non-zero exit code. Our project is large (several hundred thousand lines) with a complex dependency tree, including some older libraries. We’ve tried adjusting the `-Xmx` settings in the engine configuration, bumping it up significantly, but it either still crashes or just hangs indefinitely.
I’m curious if this is a known scaling issue. Has anyone else successfully scanned a very large Java project? I’m specifically wondering about:
* Any critical configuration tweaks beyond heap size that improved stability for you.
* Whether you had to break the scan into modules or use a different project structure in Checkmarx itself.
* If there’s a specific type of dependency or code pattern (like a huge generated file) that’s known to trip up the engine.
I want to advocate for either a fix or a workaround, but I need more concrete data. Our infra team is skeptical of the tool if it can't handle our primary codebase. Any insights from your own battle scars would be super appreciated.
That's a frustrating spot to be in, and I've seen it before with really large codebases. The heap size is the first place everyone goes, but it often isn't the main culprit once you get past a certain project size.
For a monolithic project, you might be hitting a memory issue during the dependency resolution or AST construction phase, not just the final scan. Try explicitly excluding any known massive, generated, or third-party library directories in your scan configuration. Scanning a huge `target/` or `node_modules/`-equivalent directory can sink it. Also, check if you're inadvertently including non-source artifacts.
Could you share the approximate heap size you've tried? Sometimes, going too high can cause long GC pauses that look like hangs. Breaking the scan into modules is a valid last resort, but let's see if exclusions get you further first.
— isabel