Python agent performance tuning

Adding instrumentation to an application carries some performance cost. If you're running large or complex applications, the overhead can show up in two places: application startup and runtime request handling. This page covers configuration options for both. The startup section explains how to skip Assess-related instrumentation entirely when your deployment doesn't need it. The runtime section covers ways to reduce how much analysis the agent does after your application is already running.

Startup performance

The Python Agent has a special optimization for applications that do not use Assess. If your application is taking too long to start after adding the Python Agent, try disabling Assess Mode with the CONTRAST__ASSESS__ENABLE=false environment variable. Requires Python agent 11.5.0 or later.

If your deployment does not require Assess, disabling it explicitly with the environment variable allows the agent to skip applying certain types of instrumentation at startup. This change is particularly impactful for applications that depend on large, complex libraries.

This optimization is only triggered by the environment variable; disabling Assess using any other method isn't expected to substantially improve startup time.

Runtime performance

The following options can help improve an instrumented Python application's performance after startup:

Use request sampling (Assess only)
Disable or limit stack trace creation (Assess only)
Use exclusions

Use Request Sampling

The Python Agent comes with an option to configure the agent to not re-analyze the same request multiple times. Supported by IAST (Assess) only.

Here is an example sampling configuration:

assess:
  sampling:
    enable: true  # default is false - must enable here or in Contrast UI
    baseline: 5
    request_frequency: 10
    window_ms: 180000

For the exact same request (with the same path, and the same parameters), the agent will analyze the first five instances, then only every 10th instance. This behavior resets every 180000ms. See Configure the Python agent for full details.

Disable or limit stack trace creation

The agent builds stack traces to tell the user where attacks happened or vulnerable data flowed. This is useful information, but it's costly for the agent to compute. Supported by IAST (Assess) only. See Configure the Python agent for full details.

The following stacktraces configuration turns this feature off completely or partially:

assess:
  stacktraces: NONE, # alternatives: SINK (sink only), SOME (source and sink only), ALL (everything, default)

Use exclusions

Exclusions direct the agent to skip analysis entirely for certain requests. In certain scenarios, adding exclusions for certain types of requests can significantly improve performance at the cost of lower application coverage.

Exclusions can only be configured from the Contrast UI. See Application Exclusions for details.

In this section: