High cached memory issue in Concentrator device

Issue

Customer can observe that cached memory in concentrator device is too high as shown below.

And this is "free -m" output captured by customer environment.

Cause

The cache memory is used by the kernel to speed up routine operations on an appliance.
This is not a configuration that is controlled by the concentrator service.
With the read/write requests and the number of times it is having to read from or out of the main memory, the kernel is making the call to keep the cache memory on the higher side to cater to the frequent requests by the service.
You can look at decreasing the concurrent queries on the concentrator to potentially lower this value.
You can also look at how many reports are scheduled on this device and if those can be spaced out.
Unless the available memory is not on the low side, it is basically implying that the kernel is optimizing the setup for faster read and writes.
Refer to the link below for a little more clarity about the cache memory.
https://linuxize.com/post/free-command-in-linux/

Workaround

This is an expected behavior by Cent OS design.
The cache memory is dependent on the kernel and is reserved by it for faster read/writes.
This explanation can be applied to other core devices such as decoder or broker.

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.5.1.0
Platform: CentOS
O/S Version: 7

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue