Multiple Detection Server status shows 'Unknown' within Enforce Console

Products

• Data Loss Prevention Enforce

Issue/Introduction

Data Loss Prevention (DLP) Detection Server status shows as 'Unknown' at Monitor Controller startup.

A small sub-set of Detection Servers show as 'Unknown' after an undetermined amount of time.
 

VontuMonitorController.log: java.lang.OutOfMemoryError: unable to create new native thread

Environment

DLP 14, Enforce running on Red Hat Enterprise Linux, with Ten or more Detection Servers managed by one Enforce server.
The exact number of managed Detection Servers that cause this issue is currently not known.

 

Cause

Either situation can cause this issue:

• By default, Red Hat Enterprise Linux limits the number of processes a user can run at a single time.
• DLP user, by default is protect, may have limits applied to the number of processes it can have running at one time.

Resolution

1. Log into the Enforce system as root level user.
2. Switch to root; su - root
3. Run the following command to print the limits file to the screen.
   • cat /etc/security/limits.conf
4. Review the limits.d file for any explicit limits to the protect user.

If the protect user is not restricted explicitly, add the following to the limits.conf file to raise the process limit above the default of 1024.

protect soft    nproc   4096
protect hard    nproc   63536

Save the limits.conf and restart the Enforce server.