Skip to content

mongodb wiredtiger cache OOM kill detection#110

Merged
tonymeehan merged 2 commits intoprequel-dev:mainfrom
Evad0:mongodb-wiredtiger
Jul 9, 2025
Merged

mongodb wiredtiger cache OOM kill detection#110
tonymeehan merged 2 commits intoprequel-dev:mainfrom
Evad0:mongodb-wiredtiger

Conversation

@Evad0
Copy link
Copy Markdown
Contributor

@Evad0 Evad0 commented Jul 6, 2025

CRE rule MongoDB WiredTiger cache OOM kill detection (CRE-2025-0113) Detects MongoDB Out-Of-Memory kills caused by WiredTiger cache exhaustion. Cache pressure patterns indicate dirty page eviction failures leading to uncontrolled memory growth and OS termination.

  • Add database tags: mongodb, wiredtiger, oom-kill, cache-eviction, critical-failure, database-availability
  • Add category: database-availability
  • Validated against MongoDB 8.0 with 300MB container limit triggering OOM

/claim #94
/close #94

X post Post

Reproduction setup with Docker Compose + memory pressure script
Reproducible test setup (Maintainers invited): MongoDB-WiredTiger

Live CRE Link: CRE PLAYGROUND LINK

Run test
./setup.sh
./reproduce.sh

Filter logs and test CRE rule
./filter-logs.sh
cat test-filtered.log | preq -r mongodb-wiredtiger-oom.yaml -d

@Evad0
Copy link
Copy Markdown
Contributor Author

Evad0 commented Jul 6, 2025

test.mp4

@tonymeehan tonymeehan merged commit d24389a into prequel-dev:main Jul 9, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Multiple Winners] MongoDB: Reproduce A High-Severity Failure & Write a Detection Rule [Submit by July 6 11:59 pm ET]

2 participants