000031231 - Concentrator service crashes frequently in Security Analytics 10.3.4

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000031231
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: SA Core
RSA Version/Condition: 10.3SP4
Platform: CentOS
O/S Version: 6
IssueThe concentrator service is unresponsive in Security Analytics 10.3.4, and the following blank error box pops up in Investigation: 
Investigation error
CauseThe session.cache.read.chunk may cause a bottleneck on the concentrator.  If it is incorrectly set, it can cause excessive memory usage for the concentrator service.
Resolution1) Open the Concentrator service Explore view.
2) Navigate to database->config
3) Locate two nodes named "meta.cache.read.chunk" and "session.cache.read.chunk" and change their value to 0.  This will reduce the amount of memory that the concentrator service is allowed to consume.
NOTE: This change takes immediately without restarting services or rebooting.

Attachments

    Outcomes