Manager Memory utilization is 98%

[nbadgujar]

Hello Team,

Manager Memory utilization is goes to 98%, I login into manager through SSH and use TOP command it is showing only 15% memory utilization. I also checked the EPS, it is also normal.

how to check which process eating manager memory ?

Thanks in advance

Regards,

Naresh

[pbrettle]

Are you saying that the Manager itself is consuming 98% of the allocated memory in the Java VM? If so, you should look to increase this ASAP! Check in the server.log file in /opt/arcsight/manager/logs/default and see if you are getting any references to 'GC' or 'Full GC' or in the worst case, 'memory in the red zone'. If you are getting general GC messages then its fine, otherwise its not.

Simple way to increase the JVM memory is to run the manager setup process and change it there. Go to /opt/arcsight/manager/bin and run './arcsight managersetup' and setp through the process to increase this. Be prepared to step through the other questions, but once complete, you will need to restart the manager. So be prepared for that.

[nbadgujar]

Hello Paul,

Thank you for your answer.

but i didn't see any Full GC or GC message in Server.log file.

Regards,

Naresh

[AlexMuratov1]

What is RAM allocation?

Honestly it is hard to believe that you don't see any Full GC messages since they happen at least 1 per hour (forced).

Also don't be confused with memory utilization at the Manager and OS (top).

[nbadgujar]

Thank you for your Reply Alex.

I am observing Full GC after every 5 Minute in Server.std.log files. should i need to worry about it ? what should be the next step to troubleshoot it ?

doubt is clear now about OS and Manager memory utilization.

Thank you in advance.

[ravi231]

Hello Naresh,

There is a inbuilt dashboard in ESM called “ESM System Information”in that dashboard check the “UserMemory” and “TotalMemory” you get the idea
about ESM memory utilization.

To check which resource is consuming high memory go to this link
https://<ESM IP>:8443/arcsight/web/manage.jsp?filter=Arcsight:service=CapsManager,*&updateinterval=120.

Regards ,

Ravi Kumar

[nbadgujar]

Thank you for your reply Ravi.

I checked on that dashboard, I have total memory 16 Gb and Used Memory is 11 Gb now.

I also went through the link you sent , but  lot of things are there , how to check which particular  resource consuming Memory.

Thank you in advance.

Regards,

Naresh.

[ravi231]

Hello Naresh,

https://<YOURESM IP>:8443/arcsight/web/manage.jsp

Search for “CapsManager” , then click it and scroll down.

Arcsight:service=CapsManager,id= Global Caps Manager

• ActiveLists Caps Manager
• Channel
  Caps Manager

Look for “Estimated Usage (KB)” field , it contain the overall Memory consumption by the “ActiveLists” , “Datamonitor”,”Channel” resources , Scroll down for detail info .

In ESM there is a dashboard “Rule Partial Match” ,  the rule with high partial matches consumes high memory.

Regards ,

Ravi Kumar

[Shaun]

Do a grep for "Full GC" in /opt/arcsight/manager/logs/default/server.std.log

You should optimally see one per hour.  If you want to post a snapshot of some of them here we can see how frequently and how much memory is being consumed by your ESM.

[AlexMuratov1]

I advise you to increase RAM up to 32Gb. Full GC every 5 mins is too often.