checkId: check.scanner.slice.cache plugin: stellaops.doctor.scanner severity: warn tags: [scanner, cache, slice, performance]

Slice Cache Health

This Doctor check watches the Scanner’s slice cache – the store of pre-computed code slices that lets reachability analysis reuse work instead of re-analyzing the same dependency trees on every scan. It is aimed at operators and on-call engineers who need to spot a cold, full, or thrashing cache before it slows reachability and backs up the scan queue.

What It Checks

Queries the Scanner service at /api/v1/cache/stats and evaluates slice cache effectiveness:

Evidence collected: hit_rate, hits, misses, entry_count, used_bytes, total_bytes, storage_utilization, eviction_rate.

The check requires Scanner:Url or Services:Scanner:Url to be configured.

Why It Matters

The slice cache stores pre-computed code slices used by the reachability engine. A healthy cache avoids re-analyzing the same dependency trees on every scan, reducing computation time from seconds to milliseconds. When the cache hit rate drops, reachability computations slow dramatically, causing queue backlog and delayed security feedback. When storage fills up, evictions accelerate and the cache thrashes, making it effectively useless.

Common Causes

How to Fix

Docker Compose

# Clear stale cache entries
stella scanner cache prune --stale

# Warm the cache for active projects
stella scanner cache warm

Increase cache size in docker-compose.stella-ops.yml:

services:
  scanner:
    environment:
      Scanner__Cache__MaxSizeBytes: "4294967296"  # 4 GB
      Scanner__Cache__TtlHours: "72"
      Scanner__Cache__EvictionPolicy: "LRU"
    volumes:
      - scanner-cache:/data/cache

Bare Metal / systemd

# Check cache directory size
du -sh /var/lib/stellaops/scanner/cache

# Prune stale entries
stella scanner cache prune --stale

# Warm cache
stella scanner cache warm

Edit /etc/stellaops/scanner/appsettings.json:

{
  "Cache": {
    "MaxSizeBytes": 4294967296,
    "TtlHours": 72,
    "EvictionPolicy": "LRU",
    "DataPath": "/var/lib/stellaops/scanner/cache"
  }
}

sudo systemctl restart stellaops-scanner

Kubernetes / Helm

# Check PVC usage for cache volume
kubectl exec -it <scanner-pod> -- df -h /data/cache

Set in Helm values.yaml:

scanner:
  cache:
    maxSizeBytes: 4294967296  # 4 GB
    ttlHours: 72
    evictionPolicy: LRU
    persistence:
      enabled: true
      size: 10Gi
      storageClass: fast-ssd

Verification

stella doctor run --check check.scanner.slice.cache