SDCS-SA SCSP AIX agent has out of memory errors and or IDS daemon is not running.

book

Article ID: 159086

calendar_today

Updated On:

Products

Critical System Protection Client Edition Data Center Security Server Advanced

Issue/Introduction

  The IDS service process is linked with a default memory model, which allows for a virtual size for data sections of only up to 256MB.   For normal system-level activities and most application purposes this is sufficient, however for large-scale environments where where there are hundreds of thousands of files monitored, this setting may be insufficient and can lead to out of memory errors and the service exiting or crashing during startup.   

The problem can be predicted if the topas command shows the sisidsdaemon with a PgSp value approaching 256 MB  (i.e. 180-256).

MERR,63,2013-05-06 17:59:05.000 Z-0400,C,85,R,,,UT_0050,,,,Utils Module,,,,,UT_0050,,,,UT_0050: Unexpected error occurred while running thread:  FileInitThread. Error: Out of memory

Cause

  The IDS service process is linked with a default memory model, which allows for a virtual size for data sections of only up to 256MB.

Resolution

I believe that the default value was changed for this in 5.2.9.534 from 256 Megs to 1 Gig for earlier builds use the following work around:

In this case, the memory model should be changed for the IDS service with the following steps:

1. As root, stop the IDS Service:   /etc/rc.sisidsagent stop
2. Run the commands:
        # cd /opt/Symantec/scspagent/IDS/bin
        # cp sisidsdaemon sisidsdaemon.orig
3. Edit the setting affecting the loader's memory model for the IDS service allowing up to 1GB:
        # /usr/ccs/bin/ldedit -bmaxdata:0x40000000 sisidsdaemon
3. Restart the IDS Service:  /etc/rc.sisidsagent start

Applies To

AIX running 5.2.9 builds older than build 534.