One of the challenges we ran into when developing apps was the memory limit on the docker containers in the App Framework. As you develop your apps, it pays to think about how you write your code to keep your memory foot small.


  • Limit the number of imports that you use.

    Instead of blanket importing everything in a library, import the individual methods you need out of that library.

  • Keep your internal structures small. Don’t create a loop that builds an array with hundreds or thousands of elements. Instead, do what needs to be done to each element inside the loop.
  • Use the sqlite3 database to store information, instead of storing it in an internal memory structure.

You can monitor your memory usage by doing the following:

  1. Using SSH, log in to the QRadar Console as the root user.
  2. Type: docker ps
  3. Get the docker container id for your app. You have to guess a little bit here, I use the “CREATED” as a tip for which container I may be interested in.
  4. Type: docker stats [Your_app_container_id]

    You will see a column with MEM %. When this value approaches 100% you need to start thinking about optimizing your app.


2 comments on"Tip: Memory limits when developing apps"

  1. hardik Sheth June 22, 2017

    Hi Jonathan,

    We are working on creating a custom app on Qradar. We have one problem with dashboards. On our dashboard we have around nine different panels including table format, chart and single value indicator. Few of the panels of the dashboards are not returning any response though the execution have finished if we check the app.log under docker container. The ajax response doesn’t show any error. Can you let us know if this can be anything to do with memory allocation. Our Qradar machine has 24GB of RAM / 8 cores. The container shows that it has 200MB or RAM. Can you let us know how we can resolve this error?

    • JonathanPechtaIBM June 28, 2017

      This is not likely due to a memory allocation. If there was an issue with the RAM, then the docker container would HALT/stop and you would not be able to check the app.log. I would post this question in the QRadar App Development forum as we monitor these types of questions more regularly than we do this site at the moment. You can reach the app development forum through the SDK Resources drop-down menu on the Developer Center or just use this short link:

      If you post your question there, I can get more developers to view your questions. It is a good place to get general question and troubleshooting help with your apps.

      Hope this helps…

Join The Discussion

Your email address will not be published. Required fields are marked *