Incidents are getting queued and the data is getting persisted after restarting the "incident persister"

book

Article ID: 160707

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent

Issue/Introduction

Endpoint Incidents are getting queued and the data is persisted after restarting the "Incident Persister" Service.

The following Errors are reported :

In Enforce summary :- Error: "Corrupted incident received".

Incident Persister.log provided the following information :

INFO   | jvm 9    | 2011/08/24 14:57:20 | WrapperManager Error: Server daemon died!
INFO   | jvm 9    | 2011/08/24 14:57:20 | WrapperManager Error: java.lang.OutOfMemoryError: GC overhead limit exceeded
INFO   | jvm 9    | 2011/08/24 14:57:20 | WrapperManager: The timer fell behind the system clock by 2700ms.
INFO   | jvm 9    | 2011/08/24 14:57:26 | WrapperManager: The timer fell behind the system clock by 9900ms.
INFO   | jvm 9    | 2011/08/24 14:57:32 | WrapperManager: The timer fell behind the system clock by 5700ms.
ERROR  | wrapper  | 2011/08/24 14:57:47 | JVM appears hung: Timed out waiting for signal from JVM.
ERROR  | wrapper  | 2011/08/24 14:57:47 | JVM did not exit on request, terminated
STATUS | wrapper  | 2011/08/24 14:57:52 | Launching a JVM...
INFO   | jvm 10   | 2011/08/24 14:57:53 | WrapperManager: Initializing...
INFO   | jvm 10   | 2011/08/24 15:01:48 | WrapperManager: The timer fell behind the system clock by 3400ms.

Resolution

Modify the following lines in the file VontuIncidentPersister.conf located in the directory \Vontu\Protect\config on Windows:

# Initial Java Heap Size (in MB) default 128
wrapper.java.initmemory=512

# Maximum Java Heap Size (in MB) default 256
wrapper.java.maxmemory=1024

Note :- Also make sure that we have recommended amount of physical memory on the Enforce and the Detection Servers.