After Upgrade to 11.5 Incidents Will Not Persist Because of Too Many Components


Article ID: 160512


Updated On:


Data Loss Prevention Enforce


After upgrading to 11.5, incidents on the Enforce server will not persist. 


A check of the IncidentPersister.log shows:

(SEVERE) Thread: 183 [] Exception while persisting incident l1353082737226.idc_1355157115480.idc
com.vontu.incidenthandler.UnrecoverablePersistingException: This incident has too many components so it will be discarded.


In 11.5, we introduced the config parameter "max.component.per.message" for the file on Enforce to reduce JVM Out Of Memory issues that rendered the Incident Persister inoperable.

By default this parameter is set to 1000.  Incidents exceeding the 1000 components limit not persist to the database.


A workaround is to increase this parameter to accommodate messages with more than 1000 components.

On the Enforce server, in /Vontu/Protect/config modify the and increase the following parameter:

# max.component.per.message is the maximum number of message components in an incident

Increase this to a higher number that will let the incident persister process incidents. 

However, this change can result in Out of Memory (Java) and process time out issues.

If there are OOM or time out issues, the Java Heap space for the Vontu Incident Persister may need to be doubled.

Check the JVM memory properties in /Vontu/Protect/config/VontuIncidentPersister.conf.

Double the following parameters:

# Initial Java Heap Size (in MB)

# Maximum Java Heap Size (in MB)

Where XXXX and YYYY are double the previous values.