Skip to content

Conversation

@kshi36
Copy link
Contributor

@kshi36 kshi36 commented Jan 7, 2026

Fixes #58888

This PR replaces the old pagination solution in DynamoDB events that relied on re-scanning the entire page to match a hashed checkpoint. This caused a performance hit from computing hashes to find a match and potential query processing errors if returning an empty Iterator.

The new solution uses the existing checkpointKey.Iterator to perform pagination by creating a new checkpoint at the last processed event, which is triggered if the max response size (1 MiB) is reached or the query limit is reached.

A follow-up PR will add logic to handle large events (single events > 1 MiB), which uses this refactor. The test mock mockQuery is included in this PR (to be used to test large event handling), which allows querying arbitrarily large events without using a dedicated DynamoDB instance. Current behavior only allows storing audit events of size <= 400 KiB (via maxItemSize).

changelog: Improved performance of large search queries for DynamoDB event backend

@kshi36 kshi36 marked this pull request as ready for review January 7, 2026 00:59
@github-actions github-actions bot requested review from kiosion and r0mant January 7, 2026 00:59
@github-actions github-actions bot added audit-log Issues related to Teleports Audit Log size/md labels Jan 7, 2026
Comment on lines -158 to +164
const eventSize = 50 * 1024
const eventSize = 200 * 1024
Copy link
Contributor Author

@kshi36 kshi36 Jan 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Increased eventSize to trigger the sub-page break logic:

if l.totalSize+len(data) >= events.MaxEventBytesInResponse {

I'm not sure if TestSizeBreak was meant to test another logic path, but it didn't trigger the sub-page break before.

Comment on lines 1010 to +1014
for _, tt := range tests {
// add event parquets (in one .parquet file) to mock S3 getter
payloads, err := auditEventsToParquet(tt.events)
require.NoError(t, err)
t.Run(tt.name, func(t *testing.T) {
// add event parquets (in one .parquet file) to mock S3 getter
payloads, err := auditEventsToParquet(tt.events)
require.NoError(t, err)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a t.Run call missing from my previous PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Performance hit of dynamodb events in case of large search queries

2 participants