High utilization on index partition after 8.3.1 Security Analytics upgrade

Products

• Security Analytics

Issue/Introduction

After upgrading to version 8.3.1, the index partition is being highly utilised.  When running iostat -mx 1, the logical partition used for INDEX is around 99% consistently.  This doesn't seem to affect the overall performance of the system.

Environment

version 8.3.1

Cause

With the upgrade to 8.3.1, the system maintains the older "legacy" metadata until it is overwritten by new metadata.  The process that cleans up the old legacy metadata is called "solera-mswd".  You can test whether this is the problem by running the following command to see if utilisation immediately drops on the INDEX partition.

systemctl stop monit solera-mswd

After you have confirmed the problem goes away, restart the two services:

systemctl start monit solera-mswd

Resolution

This has been resolved with the NSR-1 patch for Security Analytics for 8.3.1.  You can download this patch by going to the "My Downloads" section in the support portal and selecting version 8.3.1.

Additional Information

Here is a sample iostat output where the utilization is high.  Usually the INDEX partition is towards the bottom, but may vary depending on your configuration.  In this example, it is device dm-6.