All 15 Advanced Node.js questions
More in Advanced Node.js
What is the libuv library, and what specific role does it play inside Node.js? What is the difference between process.nextTick(), setImmediate(), and setTimeout(fn, 0) in terms of execution order? What are Node.js's built-in diagnostic reports, and how do you generate one? What is V8's hidden class mechanism, and why does it matter for writing performant Node.js code? What is backpressure in Node.js streams, and how do you handle it correctly when piping data? What is the AsyncLocalStorage API, and what problem does it solve for tracking context across asynchronous calls? How does Node.js implement the Worker Threads module differently from Child Processes, and when should each be used? What is monkey-patching in the context of Node.js APM (Application Performance Monitoring) tools, and what are its risks? What is the node:diagnostics_channel module, and how does it differ from simply emitting a custom event? How do you detect and prevent event loop blocking in a long-running Node.js service?
Advertisement
Back to results for “Performance Optimization & Profiling”
Node.js › Advanced Node.js

How do you use the --inspect flag and Chrome DevTools to profile a running Node.js application in production?

Advanced

Answer

Running node --inspect (or --inspect-brk to pause on the first line) opens a WebSocket debugging port that Chrome DevTools or VS Code can attach to, exposing the CPU profiler, heap snapshots, and live breakpoints against the running process. In production, --inspect should be bound to localhost only (never a public interface) and typically accessed through an SSH tunnel, since anyone who can connect to the inspector port gets full remote code execution in that process.
node --inspect=127.0.0.1:9229 server.js
// then open chrome://inspect in Chrome, or connect VS Code's Node debugger
// SSH tunnel from a local machine to a remote server:
// ssh -L 9229:localhost:9229 user@remote-host
Real-world example An intermittent memory leak in a production API is diagnosed by attaching Chrome DevTools via an SSH-tunneled --inspect session, taking two heap snapshots ten minutes apart, and comparing retained object counts to identify a growing array of unclosed database connections.

Common follow-ups: Why is exposing the inspector port publicly considered a critical security vulnerability?;What's the difference between --inspect and --inspect-brk in a debugging workflow?

Debugging & Diagnostics;Performance Optimization & Profiling
All 15 Advanced Node.js questions