"Data Chunks allocation failures" and Subsession allocation failures in /var/log/messages

Products

• Security Analytics

Issue/Introduction

There may be reports of "Data Chunks allocation" and Subsessions allocation failures in the messages file.  These indicate an attempt was made to index a value that was larger than 128K.  For example, a URL may be extremely large.  It would require an extreme amount of resources to index the large values as well as require much more storage space.

This might be found in the messages file:

Data Chunks allocation failures: Increased from 15383442 to 15383524
Subsessions allocation failures: Increased from 518534860 to 519031857

Environment

Security Analytics version 8.3.1

Cause

This is caused by extremely large, greater than 128k, values to be indexed.  A URL at times can be this large.  This is not a problem.  

Resolution

To find those subsessions where this has happened, search for subsession_missing_metadata = TRUE.