Server Event Code 1309 Error sending execution matrix to Aggregator

Products

• Data Loss Prevention Enterprise Suite

Issue/Introduction

Requested execution matrix was not sent to the Aggregator. Please look at FileReader and Aggregator logs.

Environment

Release : 16.0

Cause

Execution matrix size exceeded limits because all server based and endpoint policies were enabled on Endpoint Servers.

Oct 10, 2023 3:33:34 PM com.vontu.policy.loader.execution.ExecutionMatrixGenerator addConditionSet
WARNING: Low free memory detected, aborting execution matrix creation
Oct 10, 2023 3:33:34 PM com.vontu.policy.loader.execution.ExecutionMatrixGenerator generateExecutionMatrix
WARNING: The Execution Matrix exceeded the size limit
Oct 10, 2023 3:33:34 PM com.vontu.policy.loader.execution.ExecutionMatrixGenerator generateExecutionMatrix
INFO: Total rows generated: 0, Total time taken: 430 ms
Oct 10, 2023 3:51:01 PM com.vontu.detection.ExecutionMatrixSender run
SEVERE: Unexpected error. ExecutionMatrixMarshallable was not published to Aggregator.
java.lang.OutOfMemoryError: Java heap space

Resolution

1. Create a new policy group for Endpoint based policies.
2. Remove policy groups used for Discover and server-based detection from Endpoint Server.
3. Duplicate any common policies for servers into the Endpoint policy group.
4. Assign Endpoint policy group to endpoint servers.