Detection Server stays in an 'Unknown' status, while all the services are running properly in the Data Loss Prevention environment
search cancel

Detection Server stays in an 'Unknown' status, while all the services are running properly in the Data Loss Prevention environment

book

Article ID: 160121

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent Data Loss Prevention Network Discover Data Loss Prevention

Issue/Introduction

The following conditions are present within the Symantec Data Loss Prevention environment:

  • The Detection server stuck in an 'Unknown' status on the Enforce Server.
  • All the services on the Detection server seem to be running properly.
  • Restarting the Symantec DLP Detection Server Controller service on the Enforce server or the Symantec DLP Detection service on the Detection server does not help.

Within the SymantecDLPDetectionServer log, similar errors to the following error can be seen:

INFO   | jvm 4    | 2013/02/12 07:41:56 | # There is insufficient memory for the Java Runtime Environment to continue.
INFO   | jvm 4    | 2013/02/12 07:41:56 | # Native memory allocation (malloc) failed to allocate 59136 bytes for Chunk::new
ERROR  | wrapper  | 2013/02/12 07:41:58 | JVM exited unexpectedly.

Cause

Due to the configuration of any given Detection server, the default Java Heap Size may not be enough to start the Java Virtual Machine (JVM) successfully.

Resolution

  1. On the Detection server experiencing the issue, navigate to <InstallDrive>:\Program Files\Symantec\DataLossPrevention\DetectionServer\Services\ and open SymantecDLPDetectionServer.conf
  2. Take note of the following Java Heap Size values:
    • wrapper.java.initmemory
    • wrapper.java.maxmemory
  3. By default, these values are set to 128/256 respectively.  When increasing these values, follow these best practice guidelines:
    1. Always increase memory values as a factor of 128 (i.e: 256, 512, 1024).
    2. Always keep the maxmemory value twice the value of initmemory, and neither value should ever be greater than the available RAM on the server.
  4. Once changes have been made, save the file.
  5. Restart the SymantecDLPDetectionServer service.
  6. If the issue continues, restart the Detection server.  This may release any resources being held by the operating system.