Data Protection - iConsole search cache expires sooner than expected.
Article ID: 6095
Updated On:
Products
Issue/Introduction
The CA Data Protection iConsole has a registry setting 'SearchResultsCachePeriodMinutes' which specifies the result retention period (in minutes) for the event cache on the iConsole application server. This defaults to 40 Minutes.
In some scenarios the iConsole search cache expires sooner than expected, this can be seen in the iConsole logs (example below).
Feb 24, 2017 11:21:26.782MYDOMAIN\AuserI1968Search published/UK Search SP=cswgn_MySearch_Std_Search_V2_10 ID=supfj5yxse2hs2ubtkpq2355:Results:00000016 returned 2934 results in 27.68 seconds
.
Feb 24, 2017 11:32:16.821MYDOMAIN\AuserE1914The requested query results with ID=supfj5yxse2hs2ubtkpq2355:Results:00000016 were not in the cache. This could be because the search failed or because you have not accessed the results for some time. Close the results window and run the search again.
Environment
Cause
When a user logs in to iConsole and executes a search activity the "w3wp.exe" process carries out the following actions\ functions:
A user enters data (search parameters) and hits the Run Query button. The parameters are passed to the iConsole server and the stored procedure is executed using them. The results from the search are cached in the iConsole server and pages of results may be requested for display.
In addition to the results, details of how the results should be presented are obtained from the search definition and are also cached. The cached data will be kept even when users logs out from iConsole for given specified time (configurable through registry).
In this scenario a HttpTimeout is encountered and cache errors returned before the timeout limit (40 minutes) is met. This is because, by design Data Protection uses a 32-bit "w3wp.exe" application pool to support the iConsoles 32-bit binaries. The 32-bit w3wp.exe inproc Worker process for IIS has a limitation of a maximum usage of 2 GB from system memory. If the iConsole server is being stressed (i.e. lots of reviewers running lots of searches) the "w3wp.exe" process will consume a large amount of memory. when the memory usage gets towards the top end of the limit users will start seeing performance issues (slow searches) and eventually the "w3wp.exe" will terminate the threads once it reaches threshold of memory and users will see the results not in cache errors.
Resolution
Implementing additional iConsole servers to distribute the workload will alleviate this situation, alternatively you can apply some registry settings to optimize search efficiency and avoid cache timeouts.
The following settings are aimed at making the WebService more scalable and avoid frequent recycling of application pools. These settings can be adjusted to reduce the cache usage. The recommended values are pointers and should be adjusted according to the usage and environment.
1. Only return events you need. Set the "Basic Filters" in the iConsole search to control the scope of the search. For example, date range and number of events being fetched by the search.
2. “MaximumResultSetSize” is set by default at 1000. Do not change this value, higher values return more results but also consume more memory.
3. "SearchResultsCachePeriodMinutes" - Decreasing this value will help re-claim unused data sooner than later. Consider setting to 20 minutes or less.
4. "EventCachePeriodMinutes" - When an event is viewed, all the details of the event along with its blob are retrieved and stored in cache. This is to enable faster viewing of the same event in future, but this does use up resources. This setting should be adjusted based on the reviewer's behavior. If an already viewed event does not need revisiting, it is recommended to decrease the value. For example reducing the time to 1 minute.
Note: To implement changes, reset the IIS service after making changes to the registry .
Additional Information
For more information on iConsole registry setting please refer to the Data Protection product documentation.
Note: Orchestria, CA DLP and DataMinder are previous brand names for the product now known as CA Data Protection.
Feedback
