Multiple Detection Server status shows 'Unknown' within Enforce Console

Products

• Data Loss Prevention Enforce

Issue/Introduction

1. Data Loss Prevention (DLP) Detection Server status shows as 'Unknown' at Monitor Controller startup.
   1. A sub-set of Detection Servers show as 'Unknown' after an undefined amount of time.
2. Monitor Controller log entry: java.lang.OutOfMemoryError: unable to create new native thread

Environment

DLP Enforce running on Red Hat Enterprise Linux, with ten or more Detection Servers, managed by one Enforce server.

• The exact number of managed Detection Servers that cause this issue is currently undefined.
  
   

Cause

Either situation can cause this issue:

• By default, Red Hat Enterprise Linux limits the number of processes a user can run at a single time.
• The DLP user may have limits applied to the number of processes it can have running at one time.

Resolution

1. Log into the Enforce system as root level user.
2. Switch to root; su - root
3. Run the following command to print the limits file to the screen.
   • cat /etc/security/limits.conf
4. Review the limits.d file for any explicit limits to the protect user.

If the protect user is not restricted explicitly, add the following to the limits.conf file to raise the process limit above the default of 1024.

<DLP USER> soft    nproc   4096
<DLP USER> hard    nproc   63536

REPLACE the <DLP USER> with your DLP USER (generally the default.)

     5. Save the limits.conf

Restart the Enforce server.