Warning: Low matrix cache limit

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

You observe the following alert

Code: 1103

Summary: Low matrix cache limit

Detail: Execution matrix cache limit is low for this endpoint server.  Please go to Aggregator.properties on this endpoint server to tune this property.

Environment

Data Loss Prevention Endpoint Prevent 15.1 and later.

Cause

Endpoint servers must keep a copy of each execution matrix it may need. This will include different matrices for each version of the agent that exists in your environment as well as any configured endpoint discover scans. 

 

Resolution

There are two options for handling the scenario, you can either tune the detection server to compensate, or disable the feature.

Tuning Option

In Aggregator.properties on each endpoint server. Locate the following line.

matrixCacheLimitInBytes = 1000000000

Increase this incrementally until the error goes away. 

 Disable the feature.(Not possible on 16.x)

 

Locate the following setting: CommLayer.ENABLE_POLICY_MATRIX_DELTA_REPLICATION.int

Set this to 0

This must be done for every agent configuration that is applied to agents registered to a given endpoint server, or the feature will remain ‘on’ for that server, and agents whom have the feature disabled will have the full policy matrix sent to them on every check-in, resulting in high bandwidth use.