slowpoke/symfony

Which line of your code is slow. Not which query — which line.

A slow query tells you what is slow. It never tells you where, and a tool that points at vendor/doctrine/dbal/src/Connection.php:1124 has told you nothing at all.

This bundle sends Slowpoke the file and line of your code behind every Doctrine query — for every request, every Messenger message and every console command:

That last column is the whole point. Slowpoke turns it into N+1 detection and missions that name a file, each with a price in seconds of waiting per day — so the argument about what to fix first is over.

A query run from a Twig template points at the template, at the line you wrote, not at the compiled file in var/cache. That is usually where the N+1 is hiding.

Cron and workers too. A console command and a handled message are not endpoints, and the bundle does not pretend they are: they go to the Jobs page with how long they took, how often they failed and the same file:line for their queries. Nobody is waiting for them, which is exactly why nobody notices when they get slower.

Install

There is no Flex recipe yet, so enable the bundle in config/bundles.php:

That is all. No SDK, no PHP extension beyond the defaults, no code to change, no key to carry, no account anywhere. The bundle talks to the Slowpoke agent on the same machine, which needs one line in /etc/slowpoke/agent.yaml:

Optional: copy config/packages/slowpoke.yaml into your application to change a setting. Without it the bundle behaves exactly the same.

Performance

The rule this bundle is built on is the one the whole project follows: never make the application slower. Measured, not claimed, and you can run it yourself with ./bin/bench — everything the bundle does while a request is running: the Doctrine middleware, the line behind each query, building the trace.

For scale: a request that spends 800 ms in your code and your database pays about one ten-thousandth of that to be measured. Everything else happens after your visitor already has the page:

1640 lines of PHP. Three Symfony components, all of which your application already has. No runtime dependency of its own.

What is sent, and what never is

Sent only to the agent on your machine or private network:

• per request — method, route template (/orders/{id}), status code, start and end time. When no route matched, the path without its query string;
• per message — the message class (for RunCommandMessage and the other Symfony wrappers, the command or message inside), the transport it came from, whether it failed;
• per console command — the command name (app:invoices:close), how long it took, whether it exited with an error;
• per query — the SQL with placeholders, exactly as the Doctrine driver received it, the database engine, the real duration, and the first line of your own code on the stack, outside vendor/, outside the kernel cache and outside this bundle;
• per outbound HTTP call made with Symfony's HTTP client (Stripe, a partner API, another service) — the method, the remote host (and its port when it is not 80/443), the response status, how long it took, whether it failed (a transport error or a 5xx), and the line of your code that made the call. Never the URL path, the query string, headers or bodies: they carry tokens and personal data. Only when symfony/http-client is installed; the bundle's own delivery to the agent is never traced.

Never sent — bound parameter values, request parameters, headers, cookies, session, the user, exception messages. If you write literal values into raw SQL yourself ($conn->executeQuery("… WHERE email = '[email protected]'")) they are part of the statement, and the agent redacts them before anything leaves the machine.

Configuration

Everything has a default that works. Nothing has to be set.

In config/packages/slowpoke.yaml, on top of those: messenger and commands (both true) turn each kind of trace off, skip_commands adds command names to leave alone, max_sql_length (10 000), backtrace_limit (60) and code_root (%kernel.project_dir%, paths are sent relative to it).

Outbound calls. The bundle decorates http_client.transport (Symfony 6.3+, which every scoped client is built on) or http_client (5.4). Responses are lazy, so the decorator is an async one, like Symfony's RetryableHttpClient: every chunk passes through it however you read the response — getContent(), toArray(), stream() over many, or not at all (the destructor) — and the last chunk or the error ends the span, with the time the client itself measured. On 6.3+ a retried call is one span per attempt. http_client: false in the configuration does not even decorate the client; the environment variable leaves the decorator in place but lets every call through untouched.

Workers are never traced as a command — messenger:consume and friends would hold one trace open for hours and swallow the trace of every message they handle.

Compatibility

Every combination in that table runs the full suite on each push and every week, DBAL 3 and DBAL 4 both. DoctrineBundle 2.7+ registers the middleware; DBAL 2 is not supported and Composer refuses it rather than installing something that silently records nothing.

Quality

Everything runs in Docker. Nothing is installed on your machine.

Security

It reads no request data, sends nothing outside your machine or private network, and cannot break or slow a request. What it does and never does, how to report a vulnerability and how to verify a release are in SECURITY.md:

License

MIT, see LICENSE. Slowpoke itself is free and self-hosted: the measures stay on your machines, and nothing about your application ever leaves them.