FileReader does not start after enabling EDM

Products

• Data Loss Prevention
• Data Loss Prevention API Detection for Developer Apps Virtual Appliance
• Data Loss Prevention API Detection Virtual Appliance
• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention Cloud Detection Service for ICAP
• Data Loss Prevention Cloud Detection Service for REST
• Data Loss Prevention Cloud Package
• Data Loss Prevention Cloud Prevent for Microsoft Office 365
• Data Loss Prevention Cloud Service for Discovery/Connector
• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention Cloud Storage
• Data Loss Prevention Core Package
• Data Loss Prevention Data Access Governance
• Data Loss Prevention Discover Suite
• Data Loss Prevention Endpoint Discover
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention Enforce
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention for Mobile
• Data Loss Prevention for Office 365 Email and Gmail with Email Safeguard
• Data Loss Prevention Form Recognition
• Data Loss Prevention Network Discover
• Data Loss Prevention Network Email
• Data Loss Prevention Network Monitor
• Data Loss Prevention Network Monitor and Prevent for Email
• Data Loss Prevention Network Monitor and Prevent for Email and Web
• Data Loss Prevention Network Monitor and Prevent for Web
• Data Loss Prevention Network Prevent for Email
• Data Loss Prevention Network Prevent for Email Virtual Appliance
• Data Loss Prevention Network Prevent for Web Virtual Appliance
• Data Loss Prevention Network Protect
• Data Loss Prevention Network Web
• Data Loss Prevention Oracle Standard Edition 2
• Data Loss Prevention Plus Suite
• Data Loss Prevention Sensitive Image Recognition
• Data Loss Protection Oracle Standard Edition

Issue/Introduction

After adding EDM's in the Enforce Console, Detection servers are stuck in a Starting status because FileReader will not start.

FileReader0.log on the Detection server shows:

SEVERE: (DETECTION.3) Failed to initialize Detection
java.lang.OutOfMemoryError: Java heap space
    at java.util.Arrays.copyOf(Arrays.java:3181)
    at java.util.ArrayList.grow(ArrayList.java:267)
    at java.util.ArrayList.ensureExplicitCapacity(ArrayList.java:241)
    at java.util.ArrayList.ensureCapacityInternal(ArrayList.java:233)
    at java.util.ArrayList.add(ArrayList.java:464)
    at com.vontu.detection.execution.ExecutionConditionCrossRef.addConditionRow(ExecutionConditionCrossRef.java:60)
    at com.vontu.detection.execution.ExecutionMatrix.addAllConditionUseStates(ExecutionMatrix.java:98)
    at com.vontu.detection.execution.ExecutionMatrix.addExecutionRow(ExecutionMatrix.java:71)
    at com.vontu.detection.execution.ExecutionMatrixGenerator.generate(ExecutionMatrixGenerator.java:83)
    at com.vontu.detection.ExecutionUpdater.getExecutionMatrix(ExecutionUpdater.java:147)
    at com.vontu.detection.ExecutionUpdater.updateExecutor(ExecutionUpdater.java:100)
    at com.vontu.detection.ExecutionUpdater.executionMatrixUpdated(ExecutionUpdater.java:80)
    at com.vontu.detection.execution.ExecutionInfoBuilder.updateExecution(ExecutionInfoBuilder.java:268)
    at com.vontu.detection.execution.ExecutionInfoBuilder.matrixUpdated(ExecutionInfoBuilder.java:182)
    at com.vontu.detection.ExecutionMatrixUpdater.onPolicyDataChanged(ExecutionMatrixUpdater.java:81)
    at com.vontu.detection.engine.impl.DetectionEngineImpl.addPolicyObserver(DetectionEngineImpl.java:184)
    at com.vontu.detection.policy.PolicyManager.start(PolicyManager.java:113)
    at com.vontu.messaging.FileReader.start(FileReader.java:448)
    at com.vontu.messaging.FileReaderSetup.initialize(FileReaderSetup.java:110)
    at com.vontu.messaging.FileReader.main(FileReader.java:324)
May 17, 2023 11:22:44 AM com.vontu.logging.LocalLogWriter write
SEVERE: File Reader failed to start. Error starting File Reader. Java heap space No incidents will be detected.
May 17, 2023 11:22:44 AM com.vontu.messaging.FileReader stop
INFO: (DETECTION.4) Detection is shutting down

Environment

Symantec Data Loss Prevention 15.8 MP3

Cause

EDM replication needs more memory than what is currently allocated to FileReader.

Resolution

1. Increase BoxMonitor.FileReaderMemory in Server Settings
   
   Example:
   Default: BoxMonitor.FileReaderMemory = -Xrs -Xms1200M -Xmx4G
   
   Increase to 6G of memory: BoxMonitor.FileReaderMemory = -Xrs -Xms1200M -Xmx6G
   
   
2. Restart the Symantec DLP Detection Server Service on the Detection server to apply the change