FileReader memory utilization very high on WebPrevent server

Products

• Data Loss Prevention Network Prevent for Web
• Data Loss Prevention

Issue/Introduction

You observe that FileReader (java.exe) instance memory utilization is much higher than expected. In one particular environment FileReader was observed using between 14GB and 30GB of RAM after running for approximately one week's time. On these same servers that had 32GB of RAM, when FileReader memory utilization reached 30GB, other applications such as McAfee Antivirus began to crash due to out of memory errors.

Cause

This issue was caused by raising the MessageChains.NumChains value from the default of 8 to 68 on busy WebPrevent servers. This caused a great deal of memory to be claimed over time by the detection MessageChains in the native memory allocations within java.exe (JNI code used for the detection engine).

Resolution

Lower the MessageChain.NumChains setting to a 1:1 relationship with the number of logical cores assigned to the server. If there are 8 cores, NumChains should also be 8.

If there are 64 cores, then NumChains can be 64, but then system RAM will also need to be raised according to allocation demand by the FileReader java.exe process. The exact amount will vary according to environment. Currently for a WebPrevent with 8 cores we recommend 32GB of system RAM.

Additional Information

Also see: Data Loss Prevention Network Monitor and Prevent Performance Sizing Guidelines
And: About network performance sizing guidelines 16.1