search cancel

Detection Server listing as 'Unknown' in the Enforce Console, while displaying signs of a memory leak

book

Article ID: 162488

calendar_today

Updated On:

Products

Data Loss Prevention Network Discover

Issue/Introduction

Although Vontu Services start normally on a Detection Server, the server remains in an 'Unknown' status in the Enforce Console.

Within the VontuMonitor.log on the Detection Server, the following error repeats:

INFO   | jvm 47   | 2015/10/14 07:39:58 | # There is insufficient memory for the Java Runtime Environment to continue.
INFO   | jvm 47   | 2015/10/14 07:39:58 | # Native memory allocation (malloc) failed to allocate <x> bytes for ChunkPool::allocate
INFO   | jvm 47   | 2015/10/14 07:39:58 | # An error report file with more information is saved as:
INFO   | jvm 47   | 2015/10/14 07:39:58 | # <filepath>\Protect\bin\hs_err_pid6084.log
ERROR  | wrapper  | 2015/10/14 07:39:59 | JVM exited unexpectedly.

Monitoring RAM usage during the periods where the above error is reported, a massive memory leak can be seen consuming all resources before dumping and climbing again.

Cause

Certain installed 3rd-party applications can prevent Java.exe from starting under normal conditions.  The continuous ramp in memory when VontuMonitor attempts to initialize its Java Virtual Machine (JVM) is a good sign that another program is tampering with the process.

 

Resolution

NOTE:  If you are not seeing a memory leak tied with this issue, reference http://www.symantec.com/docs/TECH220418

  1. Discover the 3rd-party applications which may be hindering the VontuMonitor Java Virtual Machine.  Noting where/why any other java.exe processes may be running on the server may be a good point of reference if the conflicting application is unclear.
  2. Stop, Disable or Uninstall the 3rd-party applications connected with the issue.
  3. Restart the VontuMonitor service.