Detection Server stays in an 'Unknown' status, while all the services are running properly in the Data Loss Prevention environment

book

Article ID: 160121

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent Data Loss Prevention Network Discover

Issue/Introduction

The following conditions are present within the Symantec Data Loss Prevention environment:

  • The Detection server stuck in an 'Unknown' status on the Enforce Server.
  • All the services on the Detection server seem to be running properly.
  • Restarting the Vontu Monitor Controller service on the Enforce server or the Vontu Monitor service on the Detection server does not help.

Within the VontuMonitor log, similar errors to the following error can be seen:

INFO   | jvm 4    | 2013/02/12 07:41:56 | # There is insufficient memory for the Java Runtime Environment to continue.
INFO   | jvm 4    | 2013/02/12 07:41:56 | # Native memory allocation (malloc) failed to allocate 59136 bytes for Chunk::new
ERROR  | wrapper  | 2013/02/12 07:41:58 | JVM exited unexpectedly.

Cause

Due to the configuration of any given Detection server, the default Java Heap Size may not be enough to start the Java Virtual Machine (JVM) successfully.

Resolution

  1. On the Detection server experiencing the issue, navigate to \Protect\config\ and open VontuMonitor.conf
  2. Take note of the following Java Heap Size values:
    • wrapper.java.initmemory
    • wrapper.java.maxmemory
  3. By default, these values are set to 128/256 respectively.  When increasing these values, follow these best practice guidelines:
    1. Always increase memory values as a factor of 128 (i.e: 256, 512, 1024).
    2. Always keep the maxmemory value twice the value of initmemory, and neither value should ever be greater than the available RAM on the server.
  4. Once changes have been made, save the file.
  5. Restart the Vontu Monitor service.
  6. If the issue continues, restart the Detection server.  This may release any resources being held by the operating system.