SymantecDLPDetectionServerController service stops a short time after starting

Products

• Data Loss Prevention Enforce

Issue/Introduction

The SymantecDLPDetectionServerController service starts and runs for a few minutes and then stops or the service stops when any action is performed within Enforce. As a result all Detection server show as "Unknown" in Enforce.

Environment

Release : 15.7

Cause

The Java Wrapper in Monitor Controller is running out of memory.

The MonitorController0.log may show the following errors:

SEVERE: unexpected error in transport!
java.lang.OutOfMemoryError: GC overhead limit exceeded

.......

SEVERE: [127.0.0.1]:5703 [enforceMessaging] [3.6.5] Java heap space
java.lang.OutOfMemoryError: Java heap space

.......

Jul 19, 2021 10:53:01 AM com.vontu.monitor.controller.Service start
SEVERE: Error starting monitor controller

.......

Caused by: java.lang.OutOfMemoryError: Java heap space

Resolution

Increase the Java Heap for the SymantecDLPDetectionServerController service:

Open: <Install dir>\Program Files\Symantec\DataLossPrevention\EnforceServer\ServicesSymantecDLPDetectionServer.conf

Increase the Java Heap settings listed below:

# Initial Java Heap Size (in MB)
wrapper.java.initmemory = 1024

# Maximum Java Heap Size (in MB)
wrapper.java.maxmemory = 4098

 

*The amount of max memory needed may vary depending on the load on Enforce

The rule of thumb is 4GB per 12 detection servers

Do not increase the memory beyond 31GB.
At 32GB you lose memory compression and it becomes counter-productive.
If there is a valid reason to need high memory, create a CRE ticket with dev and ask for memory offset. In most circumstances there are better ways to handle out of memory errors than increasing the memory beyond 31GB.