Addressing Memory Release Concerns in SEP Linux Agent 14.3

Products

• Endpoint Protection

Issue/Introduction

The efficient utilization of system resources is critical for ensuring optimal performance. In the case of SEP Linux Agent 14.3, a notable issue has been identified where the sisamddaemon fails to release memory after a scan, raising concerns among users regarding potential memory leaks and system performance.

Environment

SEP Linux Agent 14.3

Red Hat Enterprise Linux 8.X

Cause

Key insights into the behavior of Linux memory management:

1. Linux Memory Reclamation Behavior:
Linux follows a strategy of reclaiming memory from a process only when essential. It does not automatically take back memory from a program unless there is a pressing need, ensuring that each program receives sufficient memory to operate smoothly without causing unnecessary disruptions.

2. Memory Usage Patterns during Scans:
The SEF engine retains definitions in memory, trimming heap memory using malloc_trim when new definitions become available, and reclaiming usable memory.

3. Memory Release by the OS:
The sisamddaemon is not withholding the memory release but rather follows the OS-initiated memory reclamation.

Resolution

Based on the investigation findings, it is affirmed that sisamddaemon's memory usage is aligned with the product's design. The memory allocations, including those for scanning files and logging, are released back to the system, to optimize memory usage after a Full Scan.