High memory usage in RHACS Central DB caused by stale network flow and process indicator data remaining cached

Solution Verified - Updated -

Issue

When network flow and process indicator collection is disabled in RHACS, the associated PostgreSQL tables (network_flows_v2, process_indicators, listening_endpoints) remain fully cached in the OS page cache.
This results in very high memory usage by the Central DB node, even though the features are disabled and no new data is expected.

Environment

  • Red Hat Advanced Cluster Security for Kubernetes 4.5+
  • Collection disabled using spec.perNode.collector.collection: NoCollection (per SecuredCluster)

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content