Yellow warning banner: There was an error highlighting the violating text for this incident

Products

• Data Loss Prevention Enforce
• Data Loss Prevention

Issue/Introduction

You are browsing incidents in the Enforce console and encounter a yellow warning banner indicating that the incident violations could not be highlighted. Refreshing the page does not resolve the issue. 

In the localhost log file on the Enforce server you see: 

Level: WARNING
Source: com.vontu.manager.report.snapshot.IncidentDetailPage
Message: (MANAGER.200) Error generating match highlighting for incident <number>, incident detail will be rendered without them
Cause:
com.vontu.manager.report.snapshot.matches.MatchHighlightingException: Error marking violating content for incident <incident number>
com.vontu.util.concurrent.BlockingQueueRuntimeException: com.vontu.util.concurrent.BlockingQueueRuntimeException: java.lang.OutOfMemoryError: Java heap space
com.vontu.util.concurrent.BlockingQueueRuntimeException: java.lang.OutOfMemoryError: Java heap space
java.lang.OutOfMemoryError: Java heap space

Environment

15.x

Cause

Insufficient memory allocated to the Java heap, or simply too many incidents in the DB (the above error occurred with over 3 million incidents stored). 

Resolution

Increase the memory allocation to the Java Heap:

On the Enforce Server <DLP INSTALL DIR>/Symantec/DataLossPrevention/EnforceServer/Services/SymantecDLPManager.conf

The defaults are: 

# Initial Java Heap Size (in MB)

wrapper.java.initmemory = 1378
wrapper.java.maxmemory = 2048

Increase the max memory to approximately 25% of available memory on the server and the initmemory to half of the max value. 

Restart the Manager service (SymantecDLPManagerService).

If the problem persists, check the article How to address out of memory errors ( OOM ) for further tuning advice.

Please note:

Do not increase the memory beyond 31GB.
At 32GB you lose memory compression and it becomes counter-productive.
 In most circumstances, there are better ways to handle out-of-memory errors than increasing the memory beyond 31GB.