EventEmitter memory leak detected

[symsal]

Description

I didn't receive any update from days so i check the log and found this

(node:7) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 abort listeners added to [EventEmitter]. Use emitter.setMaxListeners() to increase limit

Environment

1. OS : { docker }
2. OpenCTI version: { 5.3.12 }
3. OpenCTI client: { frontend }
4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

From log of docker appears this message on login.

[richard-julien]

Due to elasticsearch client. See
elastic/elasticsearch-js#1741
elastic/elasticsearch-js#1733
elastic/elasticsearch-js#1716

Waiting for the fix from elastic
Looks like now follow up in elastic/elastic-transport-js#63

[mattseymour]

Completely breaks the run time environment, is this something which can be reverted?

│ opencti-web (node:7) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 abort listeners added to [EventEmitter]. Use emitter.setMaxListeners() to increase limit                                               │
│ opencti-web (Use `node --trace-warnings ...` to show where the warning was created)                                                                                                                                                     
│ opencti-web     at Object.destroy (/opt/opencti/build/node_modules/undici/lib/api/readable.js:48:13)                                                                                                                                    │
│ opencti-web     at _me.request (/opt/opencti/build/node_modules/@elastic/transport/src/connection/UndiciConnection.ts:195:23)                                                                                                           │
│ opencti-web     at runMicrotasks (<anonymous>)                                                                                                                                                                                          │
│ opencti-web     at processTicksAndRejections (node:internal/process/task_queues:96:5)                                                                                                                                                   │
│ opencti-web     at Rme.request (/opt/opencti/build/node_modules/@elastic/transport/src/Transport.ts:462:45)                                                                                                                             │
│ opencti-web     at $F.SearchApi [as search] (/opt/opencti/build/node_modules/@elastic/elasticsearch/src/api/api/search.ts:84:10)                                                                                                        │
│ opencti-web     at elList (/opt/opencti/build/src/database/middleware-loader.ts:57:22)                                                                                                                                                  │
│ opencti-web     at closeOldWorks (/opt/opencti/build/src/manager/connectorManager.js:62:5)                                                                                                                                              │
│ opencti-web     at connectorHandler (/opt/opencti/build/src/manager/connectorManager.js:102:7)                                                                                                                                          │
│ opencti-web     at /opt/opencti/build/src/manager/connectorManager.js:124:9                                                                                                                                                             │
│ opencti-web     at Syt.#runHandlerAndScheduleTimeout (/opt/opencti/build/node_modules/set-interval-async/dist/set-interval-async-timer.cjs:36:13)                                                                                       │
│ opencti-web     at Timeout._onTimeout (/opt/opencti/build/node_modules/set-interval-async/dist/set-interval-async-timer.cjs:29:13)

[richard-julien]

I dont think its related, looks like you experiment a timeout on connecting to elasticsearch.

[symsal]

any update?

[richard-julien]

Looks like still work in progress on elastic side.
A PR is open elastic/elastic-transport-js#55 but no activity on it

[norrig]

Same issue here, except the error is thrown on opencti-docker-opencti-1, completely breaking event import.

Is there a temporary solution/workaround available?

[richard-julien]

This warning doesnt break anything. If you have an error in the import it should come from another reason

[shahidakhter786]

This warning doesnt break anything. If you have an error in the import it should come from another reason

No, It makes dashboard irresponsive, unable to even log in.

[richard-julien]

Hi @shahidakhter786 , if you have irresponsibe dashboard it must comes from another problem.

[shahidakhter786]

Hi @shahidakhter786 , if you have irresponsibe dashboard it must comes from another problem.

there's no error in logs except (node:7) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 abort listeners added to [EventEmitter]. Use emitter.setMaxListeners() to increase limit.
Also Docker container keeps showing 100% of cpu for container openctiframework even i have increased it to 16 cpus.

[CasperLx]

Same here...

[alirf81]

I am using 5.5.4 and the same warning is showing.

[alirf81]

As time goes, the opencti container consumes up to 24GB ram and it reduces to less than 6GB when I restart the project.
I set - NODE_OPTIONS=--max-old-space-size=32768

[llid3nlq]

I had the same error after the OS crashed.
With the platform running, I stopped elastic, then restarted it, and the platform came online again.

[richard-julien]

Memory leak is i think related to #2878 and not this eventEmitter warning from elastic client

[GraemeMeyerGT]

Looks like due to (accidental?) closure of the PR at Elastic repo, it is now being tracked here:

elastic/elastic-transport-js#63

[richard-julien]

Decide to patch the lib to increase the limit waiting for an official patch

[guillaumededrie]

Hi,
I'm seeing the following message in the logs (OpenCTI version 5.12.15):

(node:7) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 101 abort listeners added to [EventEmitter]. Use emitter.setMaxListeners() to increase limit

It doesn't seems to alter in any way the platform, but as it seems related to this issue and that the issue is marked as fixed, should we perform some steps in order to prevent these errors?

Regards.

[MaxwellDPS]

Still seeing this on 5.12.33

(node:7) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 101 abort listeners added to [EventEmitter]. Use emitter.setMaxListeners() to increase limit

[sorenopsy]

Still seeing in in 6.0.10
(node:7) MaxListenersExceededWarning: Possible EventEmitter memory leak detected. 11 abort listeners added to [EventEmitter]. Use emitter.setMaxListeners() to increase limit"

[richard-julien]

Reopening as our internal patch doesnt resolve the underlying problem.
Still waiting for elastic fix elastic/elastic-transport-js#63