fs-tracer: use hashmap with ttl for storing syscall state

3 files changed, 7 insertions, 4 deletions

diff --git a/fs-tracer/Cargo.toml b/fs-tracer/Cargo.toml
index 94f2a53..8b104d5 100644
--- a/fs-tracer/Cargo.toml
+++ b/fs-tracer/Cargo.toml
@@ -19,6 +19,7 @@ ctrlc = "3.4.4"
 futures = "0.3.30"
 chrono = "0.4.38"
 crossbeam-channel = "0.5.13"
+delay_map = "0.3.0"
 
 [[bin]]
 name = "fs-tracer"
diff --git a/fs-tracer/src/main.rs b/fs-tracer/src/main.rs
index c59dd53..ca1c914 100644
--- a/fs-tracer/src/main.rs
+++ b/fs-tracer/src/main.rs
@@ -109,7 +109,7 @@ async fn main() -> Result<(), anyhow::Error> {
         // Batching. TODO: we can probably increase this value but we need to increase max message
         // in kafka or compress or smth. We should probably batch taking into account the message
         // size.
-        if batched_req.len() < 4000 {
+        if batched_req.len() < 2700 {
             continue;
         }
 
diff --git a/fs-tracer/src/syscall_handler.rs b/fs-tracer/src/syscall_handler.rs
index 1148575..99b839e 100644
--- a/fs-tracer/src/syscall_handler.rs
+++ b/fs-tracer/src/syscall_handler.rs
@@ -1,11 +1,13 @@
+use std::ffi::CStr;
+
 use crossbeam_channel::Sender;
-use std::{collections::HashMap, ffi::CStr};
+use delay_map::HashMapDelay;
 
 use fs_tracer_common::SyscallInfo;
 
 pub struct SyscallHandler {
     resolved_files: Sender<String>,
-    open_files: HashMap<i32, String>,
+    open_files: HashMapDelay<i32, String>,
     total: u64,
 }
 
@@ -13,7 +15,7 @@ impl SyscallHandler {
     pub fn new(resolved_files: Sender<String>) -> Self {
         Self {
             resolved_files,
-            open_files: HashMap::new(),
+            open_files: HashMapDelay::new(std::time::Duration::from_secs(400)),
             total: 0,
         }
     }