After Upgrade to 11.5 Incidents Will Not Persist Because of Too Many Components

book

Article ID: 160512

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

After upgrading to 11.5, incidents on the Enforce server will not persist. 

 

A check of the IncidentPersister.log shows:

(SEVERE) Thread: 183 [com.vontu.incidenthandler.message.persist.IncidentPersistingThread.run] Exception while persisting incident l1353082737226.idc_1355157115480.idc
com.vontu.incidenthandler.UnrecoverablePersistingException: This incident has too many components so it will be discarded.

Cause

In 11.5, we introduced the config parameter "max.component.per.message" for the IncidentPersister.properties file on Enforce to reduce JVM Out Of Memory issues that rendered the Incident Persister inoperable.

By default this parameter is set to 1000.  Incidents exceeding the 1000 components limit not persist to the database.

Resolution

A workaround is to increase this parameter to accommodate messages with more than 1000 components.

On the Enforce server, in /Vontu/Protect/config modify the IncidentPersister.properties and increase the following parameter:

# max.component.per.message is the maximum number of message components in an incident
max.component.per.message=1000

Increase this to a higher number that will let the incident persister process incidents. 

However, this change can result in Out of Memory (Java) and process time out issues.

If there are OOM or time out issues, the Java Heap space for the Vontu Incident Persister may need to be doubled.

Check the JVM memory properties in /Vontu/Protect/config/VontuIncidentPersister.conf.

Double the following parameters:

# Initial Java Heap Size (in MB)

wrapper.java.initmemory=XXXX

# Maximum Java Heap Size (in MB)
wrapper.java.maxmemory=YYYY

Where XXXX and YYYY are double the previous values.