|Applies To||RSA Product Set: Security Analytics|
RSA Product/Service Type: SA Security Analytics Concentrator
RSA Version/Condition: 10.3.X, 10.4.X, 10.5.X
O/S Version: 6
|Issue||The Security Analytics concentrator service demonstrates instability, appearing to going offline then back on in the UI. When reviewing the concentrator's /var/log/messages file, it is observed that there are thousands of messages such as:|
NwCreateChannelByPath returned 0; code 128; error: Session 1585 has exceeded the maximum allowed channels (2000)
These messages reconcile to the same date and time of the first observed instance of the instability.
In this instance, the number of threads allocated in the concentrator configuration was set to 15; below the default value of 20, as seen in the screenshot here:
Under load, this may cause the concentrator process to become thread bound, as the concentrator process will be forced to wait for a thread to become available before a pending request can be processed.
Be sure to monitor /var/log/messages closely when the system is under load to ensure the thread value is high enough to support thread requests.