redis is throwing redis.exceptions.OutOfMemoryError even when maxmemory-policy is set in redis.conf

[AlyaGomaa]

cmd: ./slips.py -e 1 -f Dataset/CTU-Normal-35/capture_win-10-1.pcap -o output/capture_win-10-1_pcap_2026-02-20_20:39:57/ -m
host: locally

here redis crashed after 1 hour, 17 minutes of analysis

redis.exceptions.OutOfMemoryError: command not allowed when used memory > 'maxmemory'.                              
                                                                                       

redis.conf:

daemonize yes
stop-writes-on-bgsave-error no
save 
appendonly no
io-threads-do-reads yes
io-threads 4
maxmemory 3gb
maxmemory-policy volatile-lru
activedefrag no

branch: alya/fix_http_analyzer_getting_oom_killed
this is also after adding TTL/periodic cleanup of all redis keys!

• check what keys are still eating memory
• TTL in pcaps/files should be way lower than it is when analyzing an interface
• i think slips is doing manual cleanup every 1h wall-clock time instead of PCAP time, this is why old tws arent deleted?

[AlyaGomaa]

Old timewindows aren't deleted correctly! that's probably why the OOM errs

[AlyaGomaa]

i think slips is doing manual cleanup every 1h wall-clock time instead of PCAP time, this is why old tws arent deleted?

[AlyaGomaa]

fixed in fae3884
testing it.

[AlyaGomaa]

still getting the same OOM error
i'm suspecting it's pubsub and slow consumers because when debugigng
i think nothing here is concerning

(venv) alya@alya ~/Desktop/StratosphereLinuxIPS/output/capture_win-10-1.pcap_2026-02-25_02:55:54$ redis-cli -p 32768 --bigkeys      

# Scanning the entire keyspace to find biggest keys as well as
# average sizes per key type.  You can use -i 0.1 to sleep 0.1 sec
# per 100 SCAN commands (not usually needed).

100.00% ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Keys sampled: 44

-------- summary -------

Total key length in bytes is 1106 (avg len 25.14)

Biggest   hash found "profile_10.0.2.15_timewindow1_evidence" has 256 fields
Biggest string found "stderr" has 76 bytes
Biggest    set found "processed_evidence_profile_10.0.2.15_timewindow1" has 256 members
Biggest   zset found "profiles" has 3 members

0 lists with 0 items (00.00% of keys, avg size 0.00)
23 hashs with 460 fields (52.27% of keys, avg size 20.00)
0 streams with 0 entries (00.00% of keys, avg size 0.00)
12 strings with 215 bytes (27.27% of keys, avg size 17.92)
1 sets with 256 members (02.27% of keys, avg size 256.00)
8 zsets with 12 members (18.18% of keys, avg size 1.50)
(venv) alya@alya ~/Desktop/StratosphereLinuxIPS/output/capture_win-10-1.pcap_2026-02-25_02:55:54$ redis-cli -p 32768 --memkeys      

# Scanning the entire keyspace to find biggest keys as well as
# average sizes per key type.  You can use -i 0.1 to sleep 0.1 sec
# per 100 SCAN commands (not usually needed).

100.00% ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Keys sampled: 44

-------- summary -------

Total key length in bytes is 1106 (avg len 25.14)

Biggest   hash found "profile_10.0.2.15_timewindow1_evidence" has 262272 bytes
Biggest string found "stdout" has 128 bytes
Biggest    set found "processed_evidence_profile_10.0.2.15_timewindow1" has 18560 bytes
Biggest   zset found "profile_10.0.2.15_timewindow1_timeline" has 1496 bytes

0 lists with 0 bytes (00.00% of keys, avg size 0.00)
23 hashs with 290644 bytes (52.27% of keys, avg size 12636.70)
0 streams with 0 bytes (00.00% of keys, avg size 0.00)
12 strings with 784 bytes (27.27% of keys, avg size 65.33)
1 sets with 18560 bytes (02.27% of keys, avg size 18560.00)
8 zsets with 2232 bytes (18.18% of keys, avg size 279.00)