000032383 - How to solve "OutOfMemoryError" error and increase Java Heap memory for RSA Security Incident Manager (a.k.a Secops or Unified collector framework)

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Apr 9, 2019
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000032383
Applies ToRSA Product Set: Security Incident Manager, RSA Archer, RSA Netwitness
RSA Product/Service Type: SecOps/Unified Collector Framework (UCF)
RSA Version/Condition: 1.2.X, 1.3.X
IssueEvents/Alerts/Incidents stop flowing from RSA NetWitness to RSA Archer. You find the following error or similar in the collector.log file on the UCF server:

12 Jan 2016 04:16:52,616 | ERROR - JobRunShell.run(222) | Job DEFAULT.Archer.pull.getIncidents.scheduler.key threw an unhandled Exception:
java.lang.OutOfMemoryError: Java heap space
12 Jan 2016 04:16:56,881 | ERROR - ErrorLogger.schedulerError(2361) | Job (DEFAULT.Archer.pull.getIncidents.scheduler.key threw an exception.
org.quartz.SchedulerException: Job threw an unhandled exception. [See nested exception: java.lang.OutOfMemoryError: Java heap space]
                at org.quartz.core.JobRunShell.run(JobRunShell.java:224)
                at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:557)
Caused by: java.lang.OutOfMemoryError: Java heap space

CauseJava Heap memory is not sufficient to handle the current load of alerts.
WorkaroundIncrease the Java Heap memory by performing the steps below.
  1. Log into UCF server (Windows box)
  2. Navigate to: C:(root may vary)\Program Files\EMC\RSA\SA IM integration service
  3. Double click on: RSASAIMDC.exe
  4. Select "Java" tab
  5. Boost "Maximum memory pool"
The example below shows the maximum memory pool being increased from 4096 MB to 8192 MB.

User-added image