Yellow warning banner: There was an error highlighting the violating text for this incident

book

Article ID: 184537

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

You are browsing incidents in the Enforce console and encounter a yellow warning banner indicating that the incident violations could not be highlighted. Refreshing the page does not resolve the issue. 

In the localhost log file on the Enforce server you see: 

Level: WARNING
Source: com.vontu.manager.report.snapshot.IncidentDetailPage
Message: (MANAGER.200) Error generating match highlighting for incident <number>, incident detail will be rendered without them
Cause:
com.vontu.manager.report.snapshot.matches.MatchHighlightingException: Error marking violating content for incident <incident number>
com.vontu.util.concurrent.BlockingQueueRuntimeException: com.vontu.util.concurrent.BlockingQueueRuntimeException: java.lang.OutOfMemoryError: Java heap space
com.vontu.util.concurrent.BlockingQueueRuntimeException: java.lang.OutOfMemoryError: Java heap space
java.lang.OutOfMemoryError: Java heap space

Cause

Insufficient memory allocated to the Java heap, or simply too many incidents in the DB (the above error occured with over 3 million incidents stored). 

Environment

14.6 MP3 (other environments can also be affected)

Resolution

Increase the memory allocation to the Java Heap:

On the Enforce Server <Install Drive>\SymantecDLP\Protect\config\VontuManager.conf

The defaults are: 

# Initial Java Heap Size (in MB)

wrapper.java.initmemory = 1378

wrapper.java.maxmemory = 2048

 

Increase the max memory to approx 25% of available memory on the server and the initmemory to half of the max value. 

Restart the VontuManager service.

If the problem persists, check the article How to address out of memory errors ( OOM ) for futher tuning advice.