JavaBugs [dbd] duration (slow?)

SonarQube Server / Community Build
, ,
1
Setup details from /api/system/info 
"System": {
    "Version": "10.6.0.92116",
    "Edition": "Enterprise",
    "Container": true,
    "High Availability": false,
    "Official Distribution": true,
    "Force authentication": true,
    "Home Dir": "/opt/sonarqube",
    "Data Dir": "/opt/sonarqube/data",
    "Temp Dir": "/opt/sonarqube/temp",
    "Processors": 4
},
"Bundled": {
    "cayc": "2.3.0.1782 [Clean as You Code]",
    "iac": "1.31.0.10579 [IaC Code Quality and Security]",
    "plsql": "3.13.0.6725 [PL/SQL Code Quality and Security]",
    "sonarscala": "1.15.0.4655 [Scala Code Quality and Security]",
    "csharp": "9.27.0.93347 [C# Code Quality and Security]",
    "jcl": "1.2.0.1148 [JCL Code Quality]",
    "security": "10.6.0.31509 [Vulnerability Analysis]",
    "java": "8.0.1.36337 [Java Code Quality and Security]",
    "web": "3.16.0.5274 [HTML Code Quality and Security]",
    "flex": "2.12.0.4568 [Flex Code Quality and Security]",
    "xml": "2.10.0.4108 [XML Code Quality and Security]",
    "text": "2.12.1.2905 [Text Code Quality and Security]",
    "vbnet": "9.27.0.93347 [VB.NET Code Quality and Security]",
    "swift": "4.12.0.7262 [Swift Code Quality and Security]",
    "cpp": "6.56.0.72172 [CFamily Code Quality and Security]",
    "python": "4.19.0.15616 [Python Code Quality and Security]",
    "dbdpythonfrontend": "1.28.0.9315 [Dataflow Bug Detection Rules for Python]",
    "dbd": "1.28.0.9315 [Dataflow Bug Detection]",
    "go": "1.15.0.4655 [Go Code Quality and Security]",
    "jacoco": "1.3.0.1538 [JaCoCo]",
    "kotlin": "2.20.0.4382 [Kotlin Code Quality and Security]",
    "rpg": "3.9.0.5001 [RPG Code Quality]",
    "dbdjavafrontend": "1.28.0.9315 [Dataflow Bug Detection Rules for Java]",
    "pli": "1.15.0.4810 [PL/I Code Quality and Security]",
    "tsql": "1.13.0.7207 [T-SQL Code Quality and Security]",
    "vb": "2.13.0.5130 [VB6 Code Quality and Security]",
    "sonarapex": "1.15.0.4655 [Apex Code Quality and Security]",
    "javascript": "10.14.0.26080 [JavaScript/TypeScript/CSS Code Quality and Security]",
    "ruby": "1.15.0.4655 [Ruby Code Quality and Security]",
    "securitycsharpfrontend": "10.6.0.31509 [Vulnerability Rules for C#]",
    "securityjavafrontend": "10.6.0.31509 [Vulnerability Rules for Java]",
    "textenterprise": "2.12.1.2905 [Text Code Quality and Security]",
    "cfamilydependencies": "6.56.0.72172 [CFamily dependencies provider]",
    "securityjsfrontend": "10.6.0.31509 [Vulnerability Rules for JS]",
    "cobol": "5.7.0.8061 [COBOL Code Quality]",
    "securitypythonfrontend": "10.6.0.31509 [Vulnerability Rules for Python]",
    "php": "3.36.0.11813 [PHP Code Quality and Security]",
    "abap": "3.14.0.5470 [ABAP Code Quality and Security]",
    "securityphpfrontend": "10.6.0.31509 [Vulnerability Rules for PHP]",
    "javasymbolicexecution": "8.0.1.36337 [Java Advanced Code Quality Analyzer]"
}

Hello,
I am interested in some information regarding the JavaBugs [dbd] scanner. I am currently looking into improving the speed of our analysis. A full analysis takes around 14~ minutes (with a full SCM index up to 30 minutes). The log shows that quite some time is spent on this sensor (2-3min). Is this considered normal? What is this scanner doing and can it show some more logs like the JavaScanner? Also I get quite some errors/issues in the log:

sonarqube-javabugs-dbd.log (10.9 MB)

Thanks,
Patrick

2

Hi,

Welcome to the community!

Based on this log snippet, you have a very large project. “81796 functions”, to be exact.

In that context, I don’t think 2-3 minutes is unexpected for DBD analysis.

Ehm… Those are all DEBUG lines, not “errors/issues”.

 
Ann

3

Hi, and thanks for welcome :slight_smile:

I see, thanks for the feedback. Considering the project is still growing and far from being finished, this will only increase from now on. Is there anything you recommend to prevent this taking longer and longer every odd month?

Sorry, I’ve worded that wrong. I just saw “Skipping x” and “Abandoning y” and it sounds as if things aren’t analyzed properly due to complexity and therefore issues are not being properly reported. If all of these can be safely ignored and are just DEBUG lines I don’t need to care about, I’ll do so. I was just a bit worried about the amount, though I guess as it is DEBUG it does make sense that it is very verbose.

Thanks,
Patrick

4

Hi Patrick,

My best recommendation is to make sure there’s plenty of memory available to analysis. You don’t mention which scanner you’re using, so here’s the link for Gradle, and Maven.

 
HTH,
Ann