FileReader - High CPU usage and frequent restart after an upgrade.

Products

• Data Loss Prevention
• Data Loss Prevention Network Monitor
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

FileReader - High CPU usage and frequent restart after an upgrade.

DLP has been upgraded from an earlier version of DLP 15.1, 15.5 to 15.7, 15.8

The FileReader process hangs frequently with high CPU usage and restarts. 

EDM profiles are being used in the environment.

Environment

DLP 15.7, 15.8

Cause

Below errors observed in the FileReader logs while loading the EDM profile.

Class: com.vontu.profiles.monitor.loader.ProfileOperationalLogger
Method: loadFailed
Level: SEVERE
Message:  (DETECTION.302) Failed to load profile [97,207:87,888][EDM_Name]
com.vontu.profileindex.IndexException: Failed to load RAM index from /var/Symantec/DataLossPrevention/DetectionServer/15.8.00000/../../ServerPlatformCommon/15.8.00000/index
DataSource.1.67.87888.rdx.0

DataSource.1.67.87888.rdx.18.
 at com.vontu.util.concurrent.WorkerThread.run(WorkerThread.java:84)
Caused by: java.lang.Throwable: Profile loading failed
 ... 7 more
Caused by: Profile loading failed
 at com.vontu.profiles.monitor.loader.IndexLoaderHelper.loadIndex(IndexLoaderHelper.java:212)
 ... 4 more

 

Class: com.vontu.profileindex.database.ramindex.RamIndexV3
Method: <init>
Level: SEVERE
Message:  Unable to load Profile com.vontu.profileindex.database.ramindex.ProfileIdentifier@668e4980: Profile loading failed

Class: com.vontu.logging.LocalLogWriter
Method: write
Level: SEVERE
Message:  Failed to load database profile. Failed to load RAM index from /var/Symantec/DataLossPrevention/DetectionServer/15.8.00000/../../ServerPlatformCommon/15.8.00000/index
DataSource.1.67.87889.rdx.0

DataSource.1.67.87889.rdx.18.
No incidents will be detected against database profile "EDM_Name" version xxxx.

Resolution

All EDM profiles must be re-indexed after an upgrade as documented in the product guides.

EDM profile loads successfully post a re-index and does not consume CPU or restart.

Updating EDM indexes to the latest version (broadcom.com)