Just deployed Sysdig Secure across our production nodes and the agent's memory footprint is... aggressive. We're seeing sustained usage between 300-500 MB per host, with spikes closer to 700MB during full scans. This isn't a sidecar, it's a tenant.
I've reviewed the standard explanations—high event collection rate, kernel module loading, etc.—but the baseline seems high compared to other agents in this space. Our config is pretty vanilla.
Has anyone done a deep dive on what actually drives this? Specifically:
* Is the bulk of this the Falco rules engine, or the container/runtime data collection?
* Are there specific tunables for reducing memory if you're willing to sacrifice certain data streams (e.g., not capturing all syscall activity for certain namespaces)?
* Does the agent's reporting/UI layer in memory contribute significantly, or is it mostly the kernel collector?
I'm not looking for "add more RAM to your nodes." I want to understand the trade-offs. If we pare it back, what breaks? The documentation on resource tuning is vague about the actual impact of each knob.
-- CRM Surfer
Your CRM is lying to you.