• September 30, 2026
• 7 min read

Redis — Persistence, Scaling & Security¶

Persistence: RDB and AOF¶

save 3600 1 300 100 60 10000 means: snapshot if at least 1 change in 3600 s, 100 changes in 300 s, or 10000 changes in 60 s. The official Docker image uses these defaults with AOF off.

docker run -d --name redis -v redis-data:/data -p 127.0.0.1:6379:6379 redis:8 redis-server --appendonly yes
docker exec redis redis-cli INFO persistence | grep -E 'aof_enabled|rdb_last_bgsave_status'
docker exec redis ls /data /data/appendonlydir
# /data: appendonlydir  dump.rdb
# /data/appendonlydir: appendonly.aof.1.base.rdb  appendonly.aof.1.incr.aof  appendonly.aof.manifest

Since Redis 7.0 the AOF is a directory with a base file (RDB format by default, aof-use-rdb-preamble yes) plus incremental files and a manifest. Back up the whole directory, or trigger BGSAVE, wait for LASTSAVE to change and copy dump.rdb.

BGSAVE                  -- background snapshot
LASTSAVE                -- Unix time of the last successful save
BGREWRITEAOF            -- compact the AOF
CONFIG GET dir          -- where the files are ("/data" in the Docker image)

Memory & Eviction¶

maxmemory is 0 (no limit) by default on 64-bit builds — Redis grows until the OS or the container kills it. Always set it, and choose what happens when it is reached:

redis-cli CONFIG SET maxmemory 256mb
redis-cli CONFIG SET maxmemory-policy allkeys-lru
redis-cli INFO stats | grep -E 'evicted_keys|expired_keys|keyspace_(hits|misses)'

In a run with maxmemory 3mb, noeviction rejected writes with OutOfMemoryError in redis-py (a subclass of ResponseError) after about 8,000 small keys while reads still worked; after switching to allkeys-lru the same writes succeeded and evicted_keys grew. With a volatile-* policy and no keys with a TTL, nothing can be evicted and writes fail as with noeviction.

Things that use memory beyond your data: client output buffers (slow Pub/Sub subscribers, huge replies), replication backlog, the fork during saves, fragmentation (mem_fragmentation_ratio in INFO memory).

Big Keys and Slow Commands¶

Commands run one at a time, so one slow command delays every client.

Find the offenders with redis-cli --bigkeys / --memkeys, SLOWLOG GET, and LATENCY DOCTOR.

Replication, Sentinel and Cluster¶

flowchart LR
    subgraph HA["Replication + Sentinel"]
        P1[("primary")] -- async --> R1[("replica")]
        P1 -- async --> R2[("replica")]
        S["Sentinel ×3<br/>monitor + failover"] -.-> P1
    end
    subgraph C["Cluster: 16384 hash slots"]
        A[("primary A<br/>slots 0–5460")] --- A1[("replica")]
        B[("primary B<br/>slots 5461–10922")] --- B1[("replica")]
        D[("primary C<br/>slots 10923–16383")] --- D1[("replica")]
    end

Cluster rules that show up in application tests:

• MGET a b, SUNION, MULTI or a Lua script on keys from different slots fails with CROSSSLOT Keys in request don't hash to the same slot.
• Hash tags force keys into one slot: {user:42}:cart and {user:42}:profile hash only user:42 (both are slot 15880), so they can be used together.
• Clients follow MOVED / ASK redirects — use a cluster-aware client (RedisCluster), not a plain Redis pointed at one node.
• If production is a cluster, run at least a smoke suite against a cluster (or the managed service): code that works on a single node can fail with CROSSSLOT.

Security¶

A reachable Redis without authentication gives full control over the data and, historically, over the host: attackers used CONFIG SET dir + SAVE to write files such as SSH keys. Internet scans for open port 6379 are constant.

ACL SETUSER app on >app-secret ~app:* &app:* +@read +@write -@dangerous
ACL SETUSER tests on >tests-secret ~* +@all -flushall -flushdb
ACL LIST
ACL WHOAMI

redis-cli --user app --pass app-secret SET app:x 1       # OK
redis-cli --user app --pass app-secret SET other 1       # NOPERM No permissions to access a key
redis-cli --user app --pass app-secret FLUSHALL          # NOPERM User app has no permissions to run the 'flushall' command
redis-cli --user app --pass app-secret KEYS '*'          # NOPERM — KEYS is in @dangerous

• ~pattern — keys the user can access; &pattern — Pub/Sub channels; +@category / -command — allowed commands.
• Store ACLs in an aclfile (or redis.conf) — ACL SETUSER at runtime is lost on restart unless you run ACL SAVE.
• In redis-py: redis.Redis(username="app", password="app-secret") or redis://app:app-secret@host:6379/0.
• Security tests worth automating: the app user cannot FLUSHALL / CONFIG / KEYS, cannot read other prefixes, and a connection without credentials gets NOAUTH.

Monitoring¶

For Prometheus, redis_exporter exposes these metrics; managed services have their own dashboards. During load tests record Redis metrics next to API latency — a cache that stops hitting, or evictions, often explain a latency jump.

See also¶

• Redis — Overview
• Redis — Setup & redis-cli
• PostgreSQL — Admin & Operations
• Code Security
• Performance Testing