DLP crashing when making many API calls.
Article ID: 267927
Updated On:
Products
Issue/Introduction
After making many API calls to the Enforce Server, the DLP Services Crash.
Cause
This can happen if the DLP Services (specifically the SymantecDLPManager Service) does not have enough memory allocated to the Java Heap. Eventually the service runs out of memory and will crash. When reviewing the logs, you should check ALL of the service logs to see which ones are struggling and need some adjustments made.
SymantecDLPDetectionServerController.log: This service controls all communication to your Detection Servers.
SymantecDLPIncidentPersister.log: This service controls importing the incidents into the Database.
SymantecDLPManager.log: This service controls the UI and handles the API calls.
SymantecDLPNotifier.log: This service is required for all other services to function, and should not generally need to be modified.
If you see a large number of the following errors these typically indicate that the service does not have the necessary memory to function properly.
- line 1:71: unexpected token: null
- WrapperManager: The timer fell behind the system clock by 2,400 ms.
There are other reasons you may see the above errors, but most of the time you see these error messages this is due to a lack of memory allocated to the Java Heap for the service.
Resolution
** Note: Before making changes to the Java Heap settings, please make sure you have enough physical memory on the box to make the changes you intend to make.
** Note: If needed, Technical Support can help you to find a good starting point for these settings if you provide them with your Core Count, RAM, and Number of Detection Servers. But keep in mind this is just a starting point and additional adjustments may be needed depending on exactly what you are doing with your server.
** Note: Because of how Java handles memory compression, these values should never be taken beyond 31gb's without first consulting Technical Support, going above 32gb's in most cases is counter productive.
To adjust the java heap settings, you would need to modify these values in the corresponding <servicename>.conf files, save the changes, then restart the services in order for the changes to take effect.
Default Windows Path: C:\Program Files\Symantec\DataLossPrevention\EnforceServer\Services
Default Linux Path: /opt/Symantec/DataLossPrevention/EnforceServer/Services
Files to Modify: <servicename>.conf
Settings:
# Initial Java Heap Size (in MB)
wrapper.java.initmemory = 1024
# Maximum Java Heap Size (in MB)
wrapper.java.maxmemory = 2048
The "initial" memory is your starting memory, and the "maximum" is the maximum amount of memory that this process can use. In many cases as long as you have the physical memory available, you can try simply doubling the default values and that is often enough to resolve the issue.
Once you have made the changes to these values, save the file, then you must restart the service before the changes will take effect.
Feedback
