Security Analytics system was found unresponsive by ssh or iDRAC

Products

• Security Analytics

Issue/Introduction

The system was not responsive when using ssh or when accessing by iDRAC.  A reboot resolved the issue. 

 

Cause

A foreign application (splunk), was traversing millions of files in the application database each day.  When it did, the amount of memory became extremely excessive and the system eventually locked up and became non-responsive.

Applications not supplied by Broadcom are not supported and should not be added to appliances due to unexpected results.

Resolution

A reboot fixed the immediate problem.  Splunk can scan all filesystems and files, but these two file systems should be excluded from the target:  

/etc/solera/flows
/pfs

This was done in the inputs.conf and is offered as a suggestion.

[monitor:///etc]
Recursive=false
followSymlink=false
followtail=0