000035361 - Additional configuration with 10G and 1 ultra DAC configuration in RSA Security Analytics 10.6

Document created by RSA Customer Support Employee on Jul 13, 2017•Last modified by RSA Customer Support on Apr 7, 2018
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000035361
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics Server, Ultra DAC
RSA Version/Condition: 10.6
 
IssueIn an environment with a Series 5 10G Ddecoder and 1 ultra DAC, consistent packet drops may occur at high bursts of 7-10g capture.
CauseWhen DACs do not have enough throughput to sustain the capture speed, this log message can be seen on the 10G Decoder in the /var/log/messages file as shown below.


[Warning] Write thread blocked waiting for previous file flush to finish
ResolutionWith 10G capture it is recommended to invest in 2 DACs.

With one Ultra DAC and 2 SAS connections, adjust the following configuration for 10G capture to hold more packets in memory during the time of high capture bursts:

/decoder/config/pool.packet.pages=1100000

/decoder/config/capture.buffer.size=512MB

/database/config/meta.integrity.flush=normal

/database/config/session.integrity.flush=normal

/database/config/packet.integrity.flush=normal

Attachments

    Outcomes