how to increase Java memory on connectors ? – ArcSight SIEM [7 Steps]

Posted by

By default, Arcsight connectors have a specific configuration regarding java memory but on some scenarios the minimum is not the “best” configuration to handle the load/performance of the connector, so a good suggestion is to increase it.

Normally the connectors are installed on big environments with available memory, so probably you think “more memory -> better performance” but at this time, based on my experience the maximum configuration allowed for each connector regarding memory is 4096 MB.

So, if you configure a higher number of java memory than (4096 MB), it’s possible the connector will experience some perfomance issues.

The connector was build with 296 MB of memory java heap size as initial and maximum and it was tested to work on big environments without any problems but some specific scenarios require to increase the memory.

If that is the case, check the following steps to increase the memory of the connector:

1. Stop the connector.
2. Go to the installation folder, under
\current\user\agent
3. Do a backup of the file,
agent.wrapper.conf
4. Edit the original agent.wrapper.conf and change the memory like the following example,

For example,

Issue: The EPS is too high and the connector is having some performance issues, will be good to split the load in several connectors and increase the memory heap size to 1GB.

4.1 Find the following section on agent.wrapper.conf,

# Initial Java Heap Size (in MB)
wrapper.java.initmemory=256

# Maximum Java Heap Size (in MB)
wrapper.java.maxmemory=256

Note: Just edit the number “256” and change it depending your needs, you can increase it to [512 MB / 1024 MB / 2048 MB / 3072 MB and 4096 MB ] the configuration is in megabytes, for the example 1GB.

# Initial Java Heap Size (in MB)
wrapper.java.initmemory=1024

# Maximum Java Heap Size (in MB)
wrapper.java.maxmemory=1024

5. Save changes.
6. Close file.
7. Restart the connector.

On connector versions 7.7 / 7.8 & 7.9 if you increase the memory you cannot decrease it the same way, it is possible the connector will corrupt it the configuration file and stop working as expected if you use the same method to decrease the memory. For that reason a good suggestion if you need to increase the memory is to think what could be a good configuration of java memory depending on the following,

– EPS connector is handling
– Available memory on device

If you think something is not normal, just bring back the backup of the point #3 under the same path of point #2, stopping and starting the connector and test.

Advertisements

One comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s