High memory consumption of Malware Prevention SVM

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Malware Prevention SVM memory incrementally increases over a period of time as files get inspected by the SVM. Typically it is observed to have a memory consumption of over 80%

Environment

This issue could be observed in all versions of the Malware prevention SVM before and including 4.2.0

Cause

The memory consumption increases due to following reasons:

In certain scenarios, allocated memory is not released when not required. This creates a memory leak and it increases incrementally with each file being inspected.
In some scenarios, certain files continue to remain tracked in memory and those entries are not released. This increases the memory consumption incrementally with more of such files being inspected.

Resolution

For both the points above,

Memory leak issue is fixed as part of updated SVM in 4.2.0.1. In certain scenarios, where allocated memory was not being released is now released.
File tracking is optimized for memory usage with an upper bound. Stale or older file tracking entries are expired and corresponding memory is released.
Customers facing this issue have to upgrade the NAPP to 4.2.0.1 and then upgrade the SVM to 4.2.0.1.

Reference link for changing SVM appliance can be found here,  https://docs.vmware.com/en/VMware-NSX/4.2/administration/GUID-379942E9-2598-4476-929F-7552E01EEAB5.html