AnsweredAssumed Answered

High memory utilization in ESA

Question asked by Shrinidhi Shastry on Apr 9, 2016
Latest reply on Aug 31, 2016 by Michael Dickerson

Like • Show 0 Likes0
Comment • 8

In Security Analytics 10.5.1, we are facing high memory utilization in ESA. Even if I disable all the deployed rules, the free memory available in ESA is around 40% of overall memory.

Not sure where the memory is being utilized.

Before disabling the rules:

free -g -->

total used free shared buffers cached

Mem: 94 94 0 0 0 12

-/+ buffers/cache: 81 13

Swap: 7 4 3

After disabling all the rules:

free -g -->

total used free shared buffers cached

Mem: 94 55 39 0 0 17

-/+ buffers/cache: 38 56

Swap: 7 0 7

No one else has this question

Outcomes

8 Replies

Mohd Saad Khan Apr 11, 2016 3:55 AM
Mark Correct
Correct Answer
Can you check the processes using your memory by using top command and then confirm
Like • Show 0 Likes0
Actions
Shrinidhi Shastry Apr 11, 2016 5:02 AM
Mark Correct
Correct Answer
Hi Mohd Saad

PFB the snap-shot:
Like • Show 0 Likes0
Actions
Lee Kirkpatrick Apr 11, 2016 8:40 AM
Mark Correct
Correct Answer
Hi Shrinidhi,

With Linux, it will borrow unused memory for disk caching. This makes it appear as if the OS is consuming large amounts of memory unnecessarily when in actual fact it is not. This doesn't mean that it is not available for when an application requires it, the memory will be released as and when required.

To get a better understanding of how much RAM is available, when reading the output of the "free -g" command you want to be looking at the "-/+ buffers/cache" line.

It would also be useful to understand how many Concentrators the ESA consumes from as well ingestion rates for each. This could explain the high memory utilisation when the rules are enabled.

Cheers,
Lee
2 people found this helpful
Like • Show 2 Likes2
Actions
- Soumyajit Dhara @ Lee Kirkpatrick on Aug 18, 2016 12:57 AM
  Mark Correct
  Correct Answer
  Hi Lee,
  
  in 10.6, getting this same Alarms for High Memory Utilization. What should we do, if it reach around 97% of total memory.
  Note that, utilization carried out for more then 12 hours.
  Please suggest.
  Like • Show 0 Likes0
  Actions
  - Mohd Saad Khan @ Soumyajit Dhara on Aug 30, 2016 4:42 AM
    Mark Correct
    Correct Answer
    Hi,
    
    When getting such alarms on ESA indicates high utilization of memory by ESA rules (which includes large number of rules deployed on ESA or large number of events captured by ESA rules) due to which message bus gets loaded up
    
    In order to get rid of such issues either deploy less number of ESA rule or take a regular backup of tokumx database on ESA and clear alerts from database.
    Like • Show 0 Likes0
    Actions
  - Lee Kirkpatrick @ Soumyajit Dhara on Aug 30, 2016 5:31 AM
    Mark Correct
    Correct Answer
    Hi Soumyajit,
    
    I would suggest looking into the Health and Wellness view for your ESA appliance. You will be able to see memory utilisation for each rule you have deployed - this could give an indicator into which rules require tuning.
    
    More details surrounding this can be found here:
    
    View Memory Metrics for Rules - RSA Security Analytics Documentation
    
    Cheers,
    Lee
    Like • Show 1 Like1
    Actions
  - Rajbir Yadav @ Soumyajit Dhara on Aug 30, 2016 11:28 AM
    Mark Correct
    Correct Answer
    Hi Dhara,
    
    Monitor all the ESA rules in Health and wellness for memory utilisation. Select the rules that are using high memory and fine tune them for better performance. Disable all the unnecessary rules and when creating or editing any rule then use trial option for monitoring memory utilisation.
    
    Thanks..
    Like • Show 0 Likes0
    Actions
- Michael Dickerson @ Lee Kirkpatrick on Aug 31, 2016 11:47 AM
  Mark Correct
  Correct Answer
  You can also run the watch free command and watch how Linux/Centos in SA's case utilizes the memory as the requirements change. It is a good visual verification.
  Like • Show 0 Likes0
  Actions

High memory utilization in ESA

Outcomes

Related Content

Recommended Content