Skip to content

Fix V0 HTTP client operation names to prevent duplicate endpoints in APM Endpoints view#10958

Draft
jandro996 wants to merge 5 commits intomasterfrom
alejandro.gonzalez/APPSEC-61670
Draft

Fix V0 HTTP client operation names to prevent duplicate endpoints in APM Endpoints view#10958
jandro996 wants to merge 5 commits intomasterfrom
alejandro.gonzalez/APPSEC-61670

Conversation

@jandro996
Copy link
Member

@jandro996 jandro996 commented Mar 25, 2026

Summary

  • Root cause: ClientNamingV0.operationForComponent() returned the generic "http.request" for common HTTP client libraries (Apache HttpClient, HttpURLConnection, Google HTTP Client, Grizzly, Spring WebFlux, Jetty Client, etc.). The APM Endpoints view groups spans by (operationName, method, path), so client spans targeting the same URLs as the service's own endpoints appeared as duplicate, empty endpoint rows alongside the real servlet.request server entries.
  • Fix: Added explicit library-specific operation names for all affected clients, consistent with the existing pattern already used for OkHttp (okhttp.request), Play-WS (play-ws.request), and Netty client (netty.client.request). The "http.request" fallback is preserved for unknown/custom clients.
  • Scope: V0 only. V1 already handles this correctly via http.client.request / http.server.request.

Affected libraries

Component Before After
apache-httpclient / apache-httpclient5 http.request apache-httpclient.request
apache-httpasyncclient http.request apache-httpasyncclient.request
commons-http-client http.request commons-http-client.request
google-http-client http.request google-http-client.request
http-url-connection http.request http-url-connection.request
java-http-client http.request java-http-client.request
grizzly-http-async-client http.request grizzly-http-async-client.request
spring-webflux-client http.request spring-webflux-client.request
jetty-client http.request jetty-client.request
unknown/custom clients http.request http.request (unchanged)

Test plan

  • New unit test ClientNamingV0OperationNameTest certifies: each fixed library returns its specific name; pre-existing entries (okhttp, play-ws, netty, akka, pekko, jax-rs) are unaffected; unknown clients still fall back to http.request; no fixed name collides with servlet.request or serverNaming.operationForProtocol("http"); APM Endpoints view aggregation keys differ between client and server spans for the same URL
  • 24 integration test V0 classes updated to assert the new specific operation names
  • All affected modules build and pass locally

🤖 Generated with Claude Code

@jandro996 @claude
Fix V0 HTTP client operation names to prevent duplicate endpoints in …
4972ba0 
…APM Endpoints view

Common HTTP client libraries (Apache HttpClient, HttpURLConnection, etc.) were falling
through to the generic "http.request" default in ClientNamingV0.operationForComponent(),
causing the APM Endpoints view to show spurious duplicate endpoint rows — one for the
real servlet.request server span and one for each client span with the same URL path.

Each well-known HTTP client now has a distinct library-specific operation name consistent
with the existing pattern for OkHttp ("okhttp.request"), Play-WS ("play-ws.request"),
and Netty client ("netty.client.request"). The generic "http.request" fallback is kept
for truly unknown/custom HTTP clients.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@pr-commenter
Copy link

pr-commenter bot commented Mar 25, 2026 •
edited
Loading

Benchmarks

Startup

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master alejandro.gonzalez/APPSEC-61670
git_commit_date 1774389105 1774453712
git_commit_sha 1e19001 29a41b1
release_version 1.61.0-SNAPSHOT~1e19001696 1.61.0-SNAPSHOT~29a41b198e
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
ci_job_date 1774455765 1774455765
ci_job_id 1538012484 1538012484
ci_pipeline_id 104364182 104364182
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-zfyrx7zua-project-304-concurrent-0-atcbi6j4 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-zfyrx7zua-project-304-concurrent-0-atcbi6j4 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module Agent Agent
parent None None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 61 metrics, 10 unstable metrics.

Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.61.0-SNAPSHOT~29a41b198e, baseline=1.61.0-SNAPSHOT~1e19001696

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.07 s) : 0, 1069519
Total [baseline] (11.082 s) : 0, 11082230
Agent [candidate] (1.06 s) : 0, 1059524
Total [candidate] (11.037 s) : 0, 11036623
section appsec
Agent [baseline] (1.244 s) : 0, 1244386
Total [baseline] (11.17 s) : 0, 11170141
Agent [candidate] (1.245 s) : 0, 1245080
Total [candidate] (11.067 s) : 0, 11067095
section iast
Agent [baseline] (1.239 s) : 0, 1239407
Total [baseline] (11.358 s) : 0, 11357510
Agent [candidate] (1.226 s) : 0, 1225897
Total [candidate] (11.284 s) : 0, 11283529
section profiling
Agent [baseline] (1.181 s) : 0, 1180788
Total [baseline] (10.925 s) : 0, 10925427
Agent [candidate] (1.19 s) : 0, 1189548
Total [candidate] (11.119 s) : 0, 11118577
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 1.07 s -
Agent appsec 1.244 s 174.867 ms (16.4%)
Agent iast 1.239 s 169.888 ms (15.9%)
Agent profiling 1.181 s 111.268 ms (10.4%)
Total tracing 11.082 s -
Total appsec 11.17 s 87.911 ms (0.8%)
Total iast 11.358 s 275.28 ms (2.5%)
Total profiling 10.925 s -156.803 ms (-1.4%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 1.06 s -
Agent appsec 1.245 s 185.555 ms (17.5%)
Agent iast 1.226 s 166.373 ms (15.7%)
Agent profiling 1.19 s 130.024 ms (12.3%)
Total tracing 11.037 s -
Total appsec 11.067 s 30.472 ms (0.3%)
Total iast 11.284 s 246.906 ms (2.2%)
Total profiling 11.119 s 81.954 ms (0.7%) 
gantt
    title petclinic - break down per module: candidate=1.61.0-SNAPSHOT~29a41b198e, baseline=1.61.0-SNAPSHOT~1e19001696

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.208 ms) : 0, 1208
crashtracking [candidate] (1.194 ms) : 0, 1194
BytebuddyAgent [baseline] (636.517 ms) : 0, 636517
BytebuddyAgent [candidate] (629.42 ms) : 0, 629420
AgentMeter [baseline] (29.564 ms) : 0, 29564
AgentMeter [candidate] (29.525 ms) : 0, 29525
GlobalTracer [baseline] (258.086 ms) : 0, 258086
GlobalTracer [candidate] (258.26 ms) : 0, 258260
AppSec [baseline] (31.861 ms) : 0, 31861
AppSec [candidate] (31.998 ms) : 0, 31998
Debugger [baseline] (60.777 ms) : 0, 60777
Debugger [candidate] (60.735 ms) : 0, 60735
Remote Config [baseline] (589.805 µs) : 0, 590
Remote Config [candidate] (614.752 µs) : 0, 615
Telemetry [baseline] (8.84 ms) : 0, 8840
Telemetry [candidate] (8.101 ms) : 0, 8101
Flare Poller [baseline] (5.939 ms) : 0, 5939
Flare Poller [candidate] (3.578 ms) : 0, 3578
section appsec
crashtracking [baseline] (1.183 ms) : 0, 1183
crashtracking [candidate] (1.203 ms) : 0, 1203
BytebuddyAgent [baseline] (657.07 ms) : 0, 657070
BytebuddyAgent [candidate] (657.66 ms) : 0, 657660
AgentMeter [baseline] (12.06 ms) : 0, 12060
AgentMeter [candidate] (12.117 ms) : 0, 12117
GlobalTracer [baseline] (257.285 ms) : 0, 257285
GlobalTracer [candidate] (257.772 ms) : 0, 257772
IAST [baseline] (24.268 ms) : 0, 24268
IAST [candidate] (24.174 ms) : 0, 24174
AppSec [baseline] (177.69 ms) : 0, 177690
AppSec [candidate] (177.465 ms) : 0, 177465
Debugger [baseline] (66.117 ms) : 0, 66117
Debugger [candidate] (66.027 ms) : 0, 66027
Remote Config [baseline] (620.275 µs) : 0, 620
Remote Config [candidate] (622.931 µs) : 0, 623
Telemetry [baseline] (8.316 ms) : 0, 8316
Telemetry [candidate] (8.307 ms) : 0, 8307
Flare Poller [baseline] (3.594 ms) : 0, 3594
Flare Poller [candidate] (3.588 ms) : 0, 3588
section iast
crashtracking [baseline] (1.23 ms) : 0, 1230
crashtracking [candidate] (1.202 ms) : 0, 1202
BytebuddyAgent [baseline] (805.09 ms) : 0, 805090
BytebuddyAgent [candidate] (794.934 ms) : 0, 794934
AgentMeter [baseline] (11.582 ms) : 0, 11582
AgentMeter [candidate] (11.387 ms) : 0, 11387
GlobalTracer [baseline] (248.618 ms) : 0, 248618
GlobalTracer [candidate] (246.593 ms) : 0, 246593
IAST [baseline] (25.575 ms) : 0, 25575
IAST [candidate] (25.372 ms) : 0, 25372
AppSec [baseline] (26.751 ms) : 0, 26751
AppSec [candidate] (26.518 ms) : 0, 26518
Debugger [baseline] (70.948 ms) : 0, 70948
Debugger [candidate] (69.472 ms) : 0, 69472
Remote Config [baseline] (531.318 µs) : 0, 531
Remote Config [candidate] (540.804 µs) : 0, 541
Telemetry [baseline] (9.231 ms) : 0, 9231
Telemetry [candidate] (10.29 ms) : 0, 10290
Flare Poller [baseline] (3.378 ms) : 0, 3378
Flare Poller [candidate] (3.652 ms) : 0, 3652
section profiling
crashtracking [baseline] (1.157 ms) : 0, 1157
crashtracking [candidate] (1.181 ms) : 0, 1181
BytebuddyAgent [baseline] (681.708 ms) : 0, 681708
BytebuddyAgent [candidate] (686.817 ms) : 0, 686817
AgentMeter [baseline] (8.995 ms) : 0, 8995
AgentMeter [candidate] (9.056 ms) : 0, 9056
GlobalTracer [baseline] (214.96 ms) : 0, 214960
GlobalTracer [candidate] (216.246 ms) : 0, 216246
AppSec [baseline] (32.043 ms) : 0, 32043
AppSec [candidate] (32.301 ms) : 0, 32301
Debugger [baseline] (65.874 ms) : 0, 65874
Debugger [candidate] (65.232 ms) : 0, 65232
Remote Config [baseline] (561.226 µs) : 0, 561
Remote Config [candidate] (580.071 µs) : 0, 580
Telemetry [baseline] (7.658 ms) : 0, 7658
Telemetry [candidate] (8.627 ms) : 0, 8627
Flare Poller [baseline] (3.433 ms) : 0, 3433
Flare Poller [candidate] (3.562 ms) : 0, 3562
ProfilingAgent [baseline] (93.647 ms) : 0, 93647
ProfilingAgent [candidate] (94.911 ms) : 0, 94911
Profiling [baseline] (94.202 ms) : 0, 94202
Profiling [candidate] (95.477 ms) : 0, 95477
Loading
Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.61.0-SNAPSHOT~29a41b198e, baseline=1.61.0-SNAPSHOT~1e19001696

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.062 s) : 0, 1062145
Total [baseline] (8.852 s) : 0, 8852181
Agent [candidate] (1.053 s) : 0, 1052964
Total [candidate] (8.818 s) : 0, 8817538
section iast
Agent [baseline] (1.235 s) : 0, 1235421
Total [baseline] (9.59 s) : 0, 9590149
Agent [candidate] (1.242 s) : 0, 1241780
Total [candidate] (9.548 s) : 0, 9548346
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 1.062 s -
Agent iast 1.235 s 173.276 ms (16.3%)
Total tracing 8.852 s -
Total iast 9.59 s 737.968 ms (8.3%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 1.053 s -
Agent iast 1.242 s 188.816 ms (17.9%)
Total tracing 8.818 s -
Total iast 9.548 s 730.807 ms (8.3%) 
gantt
    title insecure-bank - break down per module: candidate=1.61.0-SNAPSHOT~29a41b198e, baseline=1.61.0-SNAPSHOT~1e19001696

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.212 ms) : 0, 1212
crashtracking [candidate] (1.201 ms) : 0, 1201
BytebuddyAgent [baseline] (631.955 ms) : 0, 631955
BytebuddyAgent [candidate] (627.265 ms) : 0, 627265
AgentMeter [baseline] (29.582 ms) : 0, 29582
AgentMeter [candidate] (29.245 ms) : 0, 29245
GlobalTracer [baseline] (257.761 ms) : 0, 257761
GlobalTracer [candidate] (256.181 ms) : 0, 256181
AppSec [baseline] (31.87 ms) : 0, 31870
AppSec [candidate] (31.618 ms) : 0, 31618
Debugger [baseline] (59.892 ms) : 0, 59892
Debugger [candidate] (59.469 ms) : 0, 59469
Remote Config [baseline] (594.496 µs) : 0, 594
Remote Config [candidate] (578.972 µs) : 0, 579
Telemetry [baseline] (8.073 ms) : 0, 8073
Telemetry [candidate] (7.982 ms) : 0, 7982
Flare Poller [baseline] (5.073 ms) : 0, 5073
Flare Poller [candidate] (3.504 ms) : 0, 3504
section iast
crashtracking [baseline] (1.21 ms) : 0, 1210
crashtracking [candidate] (1.2 ms) : 0, 1200
BytebuddyAgent [baseline] (802.315 ms) : 0, 802315
BytebuddyAgent [candidate] (807.081 ms) : 0, 807081
AgentMeter [baseline] (11.524 ms) : 0, 11524
AgentMeter [candidate] (11.903 ms) : 0, 11903
GlobalTracer [baseline] (248.542 ms) : 0, 248542
GlobalTracer [candidate] (249.505 ms) : 0, 249505
IAST [baseline] (25.575 ms) : 0, 25575
IAST [candidate] (25.766 ms) : 0, 25766
AppSec [baseline] (26.697 ms) : 0, 26697
AppSec [candidate] (26.968 ms) : 0, 26968
Debugger [baseline] (70.22 ms) : 0, 70220
Debugger [candidate] (68.713 ms) : 0, 68713
Remote Config [baseline] (530.341 µs) : 0, 530
Remote Config [candidate] (525.148 µs) : 0, 525
Telemetry [baseline] (9.107 ms) : 0, 9107
Telemetry [candidate] (10.224 ms) : 0, 10224
Flare Poller [baseline] (3.341 ms) : 0, 3341
Flare Poller [candidate] (3.669 ms) : 0, 3669
Loading

Load

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master alejandro.gonzalez/APPSEC-61670
git_commit_date 1774389105 1774453712
git_commit_sha 1e19001 29a41b1
release_version 1.61.0-SNAPSHOT~1e19001696 1.61.0-SNAPSHOT~29a41b198e
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
ci_job_date 1774456242 1774456242
ci_job_id 1538012488 1538012488
ci_pipeline_id 104364182 104364182
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-zfyrx7zua-project-304-concurrent-3-k3lx2mgs 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-zfyrx7zua-project-304-concurrent-3-k3lx2mgs 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 4 performance improvements and 5 performance regressions! Performance is the same for 11 metrics, 16 unstable metrics.

scenario Δ mean agg_http_req_duration_p50 Δ mean agg_http_req_duration_p95 Δ mean throughput candidate mean agg_http_req_duration_p50 candidate mean agg_http_req_duration_p95 candidate mean throughput baseline mean agg_http_req_duration_p50 baseline mean agg_http_req_duration_p95 baseline mean throughput
scenario:load:insecure-bank:iast:high_load worse
[+109.559µs; +191.525µs] or [+4.574%; +7.996%]		 worse
[+242.028µs; +552.745µs] or [+3.436%; +7.847%]		 unstable
[-215.722op/s; +46.972op/s] or [-14.547%; +3.168%]		 2.546ms 7.441ms 1398.562op/s 2.395ms 7.044ms 1482.938op/s
scenario:load:insecure-bank:iast_GLOBAL:high_load better
[-291.235µs; -198.118µs] or [-9.901%; -6.736%]		 unstable
[-837.097µs; +67.420µs] or [-10.156%; +0.818%]		 unstable
[-41.646op/s; +215.083op/s] or [-3.362%; +17.362%]		 2.697ms 7.857ms 1325.531op/s 2.941ms 8.242ms 1238.812op/s
scenario:load:insecure-bank:profiling:high_load better
[-267.125µs; -122.516µs] or [-14.288%; -6.553%]		 unstable
[-1279.203µs; -151.011µs] or [-21.925%; -2.588%]		 unstable
[+68.302op/s; +539.010op/s] or [+3.679%; +29.036%]		 1.675ms 5.119ms 2160.000op/s 1.870ms 5.835ms 1856.344op/s
scenario:load:insecure-bank:iast_FULL:high_load unsure
[+84.403µs; +274.386µs] or [+1.690%; +5.494%]		 worse
[+243.869µs; +803.529µs] or [+2.058%; +6.780%]		 unstable
[-100.888op/s; +41.638op/s] or [-12.276%; +5.067%]		 5.173ms 12.376ms 792.188op/s 4.994ms 11.852ms 821.812op/s
scenario:load:petclinic:no_agent:high_load worse
[+0.635ms; +1.955ms] or [+3.671%; +11.305%]		 worse
[+0.578ms; +3.035ms] or [+2.002%; +10.505%]		 unstable
[-46.464op/s; +10.839op/s] or [-17.747%; +4.140%]		 18.589ms 30.697ms 244.000op/s 17.294ms 28.890ms 261.812op/s
scenario:load:petclinic:tracing:high_load better
[-1.939ms; -1.034ms] or [-10.436%; -5.566%]		 better
[-2.476ms; -1.053ms] or [-8.260%; -3.512%]		 unstable
[-10.752op/s; +45.752op/s] or [-4.323%; +18.393%]		 17.096ms 28.215ms 266.250op/s 18.583ms 29.979ms 248.750op/s
Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~29a41b198e, baseline=1.61.0-SNAPSHOT~1e19001696
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.168 ms) : 1156, 1179
.   : milestone, 1168,
iast (3.081 ms) : 3045, 3118
.   : milestone, 3081,
iast_FULL (5.623 ms) : 5568, 5678
.   : milestone, 5623,
iast_GLOBAL (3.704 ms) : 3645, 3762
.   : milestone, 3704,
profiling (2.446 ms) : 2421, 2471
.   : milestone, 2446,
tracing (1.821 ms) : 1806, 1837
.   : milestone, 1821,
section candidate
no_agent (1.188 ms) : 1176, 1199
.   : milestone, 1188,
iast (3.273 ms) : 3227, 3319
.   : milestone, 3273,
iast_FULL (5.836 ms) : 5778, 5894
.   : milestone, 5836,
iast_GLOBAL (3.47 ms) : 3411, 3529
.   : milestone, 3470,
profiling (2.092 ms) : 2072, 2113
.   : milestone, 2092,
tracing (1.867 ms) : 1851, 1884
.   : milestone, 1867,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.168 ms [1.156 ms, 1.179 ms] -
iast 3.081 ms [3.045 ms, 3.118 ms] 1.914 ms (163.9%)
iast_FULL 5.623 ms [5.568 ms, 5.678 ms] 4.455 ms (381.5%)
iast_GLOBAL 3.704 ms [3.645 ms, 3.762 ms] 2.536 ms (217.2%)
profiling 2.446 ms [2.421 ms, 2.471 ms] 1.279 ms (109.5%)
tracing 1.821 ms [1.806 ms, 1.837 ms] 653.71 µs (56.0%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.188 ms [1.176 ms, 1.199 ms] -
iast 3.273 ms [3.227 ms, 3.319 ms] 2.085 ms (175.6%)
iast_FULL 5.836 ms [5.778 ms, 5.894 ms] 4.649 ms (391.5%)
iast_GLOBAL 3.47 ms [3.411 ms, 3.529 ms] 2.282 ms (192.2%)
profiling 2.092 ms [2.072 ms, 2.113 ms] 904.97 µs (76.2%)
tracing 1.867 ms [1.851 ms, 1.884 ms] 679.551 µs (57.2%)
Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~29a41b198e, baseline=1.61.0-SNAPSHOT~1e19001696
    dateFormat X
    axisFormat %s
section baseline
no_agent (17.826 ms) : 17648, 18005
.   : milestone, 17826,
appsec (18.756 ms) : 18564, 18949
.   : milestone, 18756,
code_origins (17.687 ms) : 17512, 17862
.   : milestone, 17687,
iast (18.028 ms) : 17844, 18211
.   : milestone, 18028,
profiling (18.907 ms) : 18714, 19100
.   : milestone, 18907,
tracing (18.766 ms) : 18578, 18954
.   : milestone, 18766,
section candidate
no_agent (19.131 ms) : 18936, 19325
.   : milestone, 19131,
appsec (18.344 ms) : 18158, 18530
.   : milestone, 18344,
code_origins (17.867 ms) : 17692, 18042
.   : milestone, 17867,
iast (17.786 ms) : 17608, 17963
.   : milestone, 17786,
profiling (18.546 ms) : 18360, 18732
.   : milestone, 18546,
tracing (17.527 ms) : 17354, 17700
.   : milestone, 17527,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 17.826 ms [17.648 ms, 18.005 ms] -
appsec 18.756 ms [18.564 ms, 18.949 ms] 929.813 µs (5.2%)
code_origins 17.687 ms [17.512 ms, 17.862 ms] -139.785 µs (-0.8%)
iast 18.028 ms [17.844 ms, 18.211 ms] 201.041 µs (1.1%)
profiling 18.907 ms [18.714 ms, 19.1 ms] 1.081 ms (6.1%)
tracing 18.766 ms [18.578 ms, 18.954 ms] 939.215 µs (5.3%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 19.131 ms [18.936 ms, 19.325 ms] -
appsec 18.344 ms [18.158 ms, 18.53 ms] -786.493 µs (-4.1%)
code_origins 17.867 ms [17.692 ms, 18.042 ms] -1.264 ms (-6.6%)
iast 17.786 ms [17.608 ms, 17.963 ms] -1.345 ms (-7.0%)
profiling 18.546 ms [18.36 ms, 18.732 ms] -584.351 µs (-3.1%)
tracing 17.527 ms [17.354 ms, 17.7 ms] -1.604 ms (-8.4%)

Dacapo

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master alejandro.gonzalez/APPSEC-61670
git_commit_date 1774389105 1774453712
git_commit_sha 1e19001 29a41b1
release_version 1.61.0-SNAPSHOT~1e19001696 1.61.0-SNAPSHOT~29a41b198e
See matching parameters
Baseline Candidate
application biojava biojava
ci_job_date 1774455947 1774455947
ci_job_id 1538012492 1538012492
ci_pipeline_id 104364182 104364182
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-zfyrx7zua-project-304-concurrent-0-uvge3kft 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-zfyrx7zua-project-304-concurrent-0-uvge3kft 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics.

Execution time for biojava 
gantt
    title biojava - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~29a41b198e, baseline=1.61.0-SNAPSHOT~1e19001696
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.477 s) : 15477000, 15477000
.   : milestone, 15477000,
appsec (14.872 s) : 14872000, 14872000
.   : milestone, 14872000,
iast (18.7 s) : 18700000, 18700000
.   : milestone, 18700000,
iast_GLOBAL (17.973 s) : 17973000, 17973000
.   : milestone, 17973000,
profiling (15.399 s) : 15399000, 15399000
.   : milestone, 15399000,
tracing (14.89 s) : 14890000, 14890000
.   : milestone, 14890000,
section candidate
no_agent (14.953 s) : 14953000, 14953000
.   : milestone, 14953000,
appsec (14.736 s) : 14736000, 14736000
.   : milestone, 14736000,
iast (18.052 s) : 18052000, 18052000
.   : milestone, 18052000,
iast_GLOBAL (17.981 s) : 17981000, 17981000
.   : milestone, 17981000,
profiling (14.782 s) : 14782000, 14782000
.   : milestone, 14782000,
tracing (14.827 s) : 14827000, 14827000
.   : milestone, 14827000,
Loading
  • baseline results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 15.477 s [15.477 s, 15.477 s] -
appsec 14.872 s [14.872 s, 14.872 s] -605.0 ms (-3.9%)
iast 18.7 s [18.7 s, 18.7 s] 3.223 s (20.8%)
iast_GLOBAL 17.973 s [17.973 s, 17.973 s] 2.496 s (16.1%)
profiling 15.399 s [15.399 s, 15.399 s] -78.0 ms (-0.5%)
tracing 14.89 s [14.89 s, 14.89 s] -587.0 ms (-3.8%)
  • candidate results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 14.953 s [14.953 s, 14.953 s] -
appsec 14.736 s [14.736 s, 14.736 s] -217.0 ms (-1.5%)
iast 18.052 s [18.052 s, 18.052 s] 3.099 s (20.7%)
iast_GLOBAL 17.981 s [17.981 s, 17.981 s] 3.028 s (20.3%)
profiling 14.782 s [14.782 s, 14.782 s] -171.0 ms (-1.1%)
tracing 14.827 s [14.827 s, 14.827 s] -126.0 ms (-0.8%)
Execution time for tomcat 
gantt
    title tomcat - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~29a41b198e, baseline=1.61.0-SNAPSHOT~1e19001696
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.466 ms) : 1454, 1477
.   : milestone, 1466,
appsec (3.786 ms) : 3564, 4008
.   : milestone, 3786,
iast (2.254 ms) : 2185, 2323
.   : milestone, 2254,
iast_GLOBAL (2.288 ms) : 2219, 2358
.   : milestone, 2288,
profiling (2.086 ms) : 2030, 2141
.   : milestone, 2086,
tracing (2.057 ms) : 2003, 2110
.   : milestone, 2057,
section candidate
no_agent (1.467 ms) : 1456, 1478
.   : milestone, 1467,
appsec (3.769 ms) : 3548, 3990
.   : milestone, 3769,
iast (2.252 ms) : 2182, 2321
.   : milestone, 2252,
iast_GLOBAL (2.292 ms) : 2222, 2362
.   : milestone, 2292,
profiling (2.076 ms) : 2020, 2131
.   : milestone, 2076,
tracing (2.057 ms) : 2004, 2111
.   : milestone, 2057,
Loading
  • baseline results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 1.466 ms [1.454 ms, 1.477 ms] -
appsec 3.786 ms [3.564 ms, 4.008 ms] 2.32 ms (158.3%)
iast 2.254 ms [2.185 ms, 2.323 ms] 788.237 µs (53.8%)
iast_GLOBAL 2.288 ms [2.219 ms, 2.358 ms] 822.501 µs (56.1%)
profiling 2.086 ms [2.03 ms, 2.141 ms] 619.748 µs (42.3%)
tracing 2.057 ms [2.003 ms, 2.11 ms] 590.836 µs (40.3%)
  • candidate results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 1.467 ms [1.456 ms, 1.478 ms] -
appsec 3.769 ms [3.548 ms, 3.99 ms] 2.302 ms (156.9%)
iast 2.252 ms [2.182 ms, 2.321 ms] 784.862 µs (53.5%)
iast_GLOBAL 2.292 ms [2.222 ms, 2.362 ms] 825.049 µs (56.2%)
profiling 2.076 ms [2.02 ms, 2.131 ms] 608.882 µs (41.5%)
tracing 2.057 ms [2.004 ms, 2.111 ms] 590.189 µs (40.2%)

@jandro996 jandro996 added type: bug Bug report and fix comp: asm waf Application Security Management (WAF) labels Mar 25, 2026
jandro996 and others added 4 commits March 25, 2026 14:13
@jandro996 @claude
Fix operation name assertions in secondary tests affected by ClientNa…
20b4258 
…mingV0 change

Tests for AWS SDK, Elasticsearch REST client, OpenSearch, and Mule 4 each include
child HTTP client spans within their trace assertions. These spans had their
operation name hardcoded as "http.request" because the underlying HTTP libraries
(Apache HttpClient and Grizzly async client) previously fell through to that default.

Now that these components have explicit V0 operation names, update the assertions
to match: apache-httpclient.request, apache-httpasyncclient.request, and
grizzly-http-async-client.request accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jandro996 @claude
Fix http.request operation name in OpenLiberty smoke tests
2a59e77 
The Spring Boot OpenLiberty smoke app uses RestTemplate backed by
HttpURLConnection, which now produces "http-url-connection.request"
instead of the generic "http.request" after the ClientNamingV0 fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jandro996 @claude
Fix remaining test assertions for renamed HTTP client operation names…
7d861f5 
… (round 3)

Update Spring WebFlux bootTest, Spring Cloud Zuul, and AWS SNS tests to use
the new component-specific operation names introduced for V0 schema.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jandro996 @claude
Fix Twilio test assertion for renamed apache-httpclient operation nam…
29a41b1 
…e (round 4)

TwilioClientV0Test.httpClientOperation() was using the generic ClientV0.operation()
which returned "http.request". Update to "apache-httpclient.request" directly since
Twilio uses the apache-httpclient component for its underlying HTTP requests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

comp: asm waf Application Security Management (WAF) type: bug Bug report and fix

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jandro996