Performance Issue: DefectDojo UI & API become unresponsive under heavy load

[jugalb-icpl]

Problem Summary

We are experiencing performance issues with DefectDojo in the following scenario:

• When multiple scans are uploaded or many tasks are running in the background, the DefectDojo UI becomes unresponsive and API requests stop responding.
• It appears that if the VM is under CPU or memory pressure, the entire application becomes unusable until the load drops.

Observations

• The Django server (or workers) seem to get blocked or slowed down significantly during heavy upload or processing.

• This affects:

  • Accessing the UI
  • Fetching data via API
  • Uploading new scans

Questions

1. What are the best practices to improve performance in production environments?
2. Are there recommended settings for scaling DefectDojo under heavy load (e.g., using Celery workers, uWSGI/Gunicorn config, DB tuning, etc.)?
3. Is there a way to isolate or limit background tasks so that the web/API services stay responsive?
4. Are there monitoring or queueing patterns used by others to prevent these full slowdowns?

Setup Details

• DefectDojo version: (2.31.4)
• Deployment method: Docker
• VM specs: [4 CPU Core, 8 GB]
• DB used: [MySQL/PostgreSQL + version]

Any suggestions, tuning advice, or architecture recommendations would be greatly appreciated!

---

[valentijnscholten]

By default Defect Dojo runs with 2 processes and 2 threads per process. It sounds like you're running into this limit of roughly 4 parallel requests being handled. You could experiment with setting environment variables DD_UWSGI_NUM_OF_PROCESSES and DD_UWSGI_NUM_OF_THREADS

django-DefectDojo/docker/entrypoint-uwsgi.sh

Lines 35 to 45 in a02afe3

	exec uwsgi \
	"--${DD_UWSGI_MODE}" "${DD_UWSGI_ENDPOINT}" \
	--protocol uwsgi \
	--enable-threads \
	--processes "${DD_UWSGI_NUM_OF_PROCESSES:-2}" \
	--threads "${DD_UWSGI_NUM_OF_THREADS:-2}" \
	--wsgi dojo.wsgi:application \
	--buffer-size="${DD_UWSGI_BUFFER_SIZE:-8192}" \
	--http 0.0.0.0:8081 --http-to "${DD_UWSGI_ENDPOINT}" \
	--logformat "${DD_UWSGI_LOGFORMAT:-$DD_UWSGI_LOGFORMAT_DEFAULT}" \
	$EXTRA_ARGS

[valentijnscholten]

@jugalb-icpl how did it go? Just also wanted to leave a link here to some other considerations to make when running in production: https://docs.defectdojo.com/en/open_source/installation/running-in-production/. I also notice you're running an 18 months old version of Defect Dojo which is probably less performant than the latest and greatest 2.49.3