Hello people,
this is my first thread here, so I apologize for whathever I miss.
I'm working on a threat detection engine, based on Drools 3.0.5
The rule structure (written in XML) is something like this:
<rule name="SWL1_d0e32">
<lhs>
<column identifier="vulnObject"
object-type="SoftwareElement">
<literal field-name="name" evaluator="matches"
value=".*?Firefox"/>
<literal field-name="version" evaluator="=="
value="0.8"/>
</column>
</lhs>
<rhs>assert ( new SoftwareThreat ( vulnObject,
SoftwareThreat.HIGH_RISK, SoftwareThreat.LOW_RISK ,
SoftwareThreat.LOW_RISK ));</rhs>
</rule>
Well, the problem is: serializing a rulebase with more than 30000 rules
like this.
This is the code:
PackageBuilderConfiguration conf = new
PackageBuilderConfiguration();
conf.setJavaLanguageLevel( "1.5" );
PackageBuilder builder = new PackageBuilder( conf );
Reader source = new InputStreamReader(
DroolsCIMAPI.class.getResourceAsStream( "/DroolsRuleset_TEST32000.xml" ) );
try {
builder.addPackageFromXml( source );
Package pkg = builder.getPackage();
FileOutputStream tempFile = new
FileOutputStream("./SWL1_package_TEST.bin");
ObjectOutput oos = new ObjectOutputStream(tempFile);
pkg.writeExternal(oos);
oos.flush();
oos.close();
tempFile.flush();
tempFile.close();
} catch (DroolsParserException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
Actually the serialization works for relatively "small" rulesets
(<20000, increasing max heapsize to 256m)... But when using rulesets
over 30000 rules (eg. this sample test) the process hangs exactly in
"pkg.writeExternal(oos)" filling up the cpu to 100%... without writing,
obviously.
I checked the filesize of every serialized pakage (smaller), seeing that
they are always under 50Mb.
A note: without serialization, everything works fine.
Maybe a 50Mb limit somewere? Maybe I'm the newbest Drools user ever? :)
Thanks in advance.
Fabio,
Politecnico di Torino
Italy