Summary
SmartConnector encountered an unexpected memory error. As a result, it has been generating numerous .hprof files, which are rapidly consuming the entire storage capacity of the device.

Products
ArcSight Enterprise Security Manager (ESM)

Environment
ArcSight ESM - any version
MISP SmartConnector - any version

Situation
SmartConnector encountered an unexpected memory error. As a result, it has been generating numerous .hprof files, which are rapidly consuming the entire storage capacity of the device.

Cause
MISP SmartConnector runs out of memory in the Java Heap

Resolution
1.Go to current/user/agent/agent.wrapper.conf and modify as below:
Initial Java Heap Size (in MB)
wrapper.java.initmemory=2048

Maximum Java Heap Size (in MB)
wrapper.java.maxmemory=4096

2. Clear the cache and delete remaining hprof files on the connector

1.Stop the services for the connector you want to delete the cache from.
2.Delete remaining.hprof files
3.Navigate to *ArcSight*\current\user\agent\agentdata.
4.Remove the files from the directory.
5.Start the services for the connector.
6..Login to ArcSight and check the connector dashboard it should show Estimated Cache Size at 0.

Monitor for 24 hours if .hprof files have stopped being generated.

Knowledge Base Article Link

URL Name
KM000017433