Maven 2.x FindBugs Plugin

This has to do with changes in the Findbugs analysis. This the Findbugs code and not the plug-in.

As I've written in MFINDBUGS-104 I tried it with the same FindBugs version underneath with plugin 2.1 and it was at the same speed as 2.1 with the bundled FindBugs version.

We suspected that the degradation has to do with the per-module forking of the VM.

Check to make sure you really are using the 1.3.9 version of FindBugs. Other users using Findbugs standalone are noticing a slow down. This is due to some new analysis in Findbugs. The upcoming release has some optimizations.

It prints:
[INFO] [findbugs:findbugs {execution: default-cli}]
[...]
[INFO] Using FindBugs Version: 1.3.9

Looks pretty much to me, like it's really using FindBugs 1.3.9

Use the fork option to allow a JVM to fork for a findbugs analysis. The default value is true.

It didn't get any better:

findbugs plugin 2.3.2:

~ 3:30 min (it doesn't make much difference if I use <fork>false</fork> or not)

findbugs plugin 2.1:

~ 1:30 min

Findbugs changed since 1.3.8 used in the earlier versions. You will need change some of the configuration for your scans. What do you have set for the effort? Do you use any filter files?

Configuration for plugin 2.1 (from mvn help:effective-pom):

 
       <plugin>
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>findbugs-maven-plugin</artifactId>
          <version>2.1</version>
          <dependencies>
            <dependency>
              <groupId>com.google.code.findbugs</groupId>
              <artifactId>findbugs</artifactId>
              <version>1.3.9</version>
              <scope>compile</scope>
            </dependency>
          </dependencies>
          <configuration>
            <findbugsXmlOutput>true</findbugsXmlOutput>
            <findbugsXmlWithMessages>true</findbugsXmlWithMessages>
            <xmlOutput>false</xmlOutput>
            <effort>Default</effort>
            <threshold>Normal</threshold>
            <excludeFilterFile>findbugs-exclude.xml</excludeFilterFile>
          </configuration>
        </plugin>

For 2.3.2 (also effective-pom, of course)

 
        <plugin>
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>findbugs-maven-plugin</artifactId>
          <version>2.3.2</version>
          <configuration>
            <findbugsXmlOutput>true</findbugsXmlOutput>
            <findbugsXmlWithMessages>true</findbugsXmlWithMessages>
            <xmlOutput>false</xmlOutput>
            <effort>Default</effort>
            <threshold>Normal</threshold>
            <excludeFilterFile>findbugs-exclude.xml</excludeFilterFile>
            <fork>false</fork>
          </configuration>
        </plugin>

findsbugs-exclude.xml looks like this:

<FindBugsFilter>
     <Match>
        <!-- exclude all warnings in generated code -->
       <Package name="~ich\.corba.*" />
     </Match>
</FindBugsFilter>

Our project with a high threshold did not slow on version 1.3.9 but medium or normal did. It can vary by the project and code size.
After that the plugin does not have any control on the length of time findbugs takes. The fork option typically will only affect multimodule projects with a small amount of code to check in each module.
You can use the 2.3.3-SNAPSHOT version and set the trace option for findbugs to get output of the findbugs run.

Sorry, but I didn't understand, why you think that's not a bug.
I'm using Findbugs 1.3.9 in both cases and have the same effort and threshold in both cases.
In fact, you've also admitted that it did slow down for you with medium and normal threshold.

So IMO there must be some difference how the maven plugin controls FindBugs, mustn't it?
Otherwise I couldn't explain how that time difference could be.

I just noticed something in the chain. There was not a 2.1 version of the plugin. The dependency poms were not correct. One of the reasons we have a staging repo now.
All the versions after 2.0.1 used findbugs 1.3.9 instead of 1.3.8

Well I've definitely a 2.1 in my local repository and I can also see it on maven central. Based on the publication date, it's maybe just a renamed 2.0.1

Anyway, the performance characteristics of 2.0.1 seem to be identical to 2.1

Sorry, to keep bothering you with this topic, but I'm still trying to understand the reason for the longer times (and hence why it 'Won't Fix')
Is the new version now really doing more (e.g. checking more bug patterns)
OR
is it doing the same and just (for some reason) needs more time to do it?

Ergo, in the 2nd case there wouldn't be any motivation for me to ever upgrade to findbugs-plugin 2.3.x