How to free cached memory on a device in RSA Security Analytics

Issue

Sometimes, particularly on Hybrids and VMs, there could be memory shortfalls. This can be seen when viewing top or free. At certain times, the memory is allocated to cached items which are no longer needed. When this occurs, performance issues may result in degrading investigation speed.

Resolution

To free cached memory:

1. SSH to the appliance as root.

2. Stop all the nw services running on the appliance, (such as nwdecoder, nwconcentrator, nwarchiver, nwlogdecoder...etc)

3. Type in the below command:

  echo 3 > /proc/sys/vm/drop_caches

4. Start all nw services of the appliance.

5. Check the memory consumption with either the top or free command.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics UI
RSA Version/Condition: 10.x , 11.x
Platform: CentOS
O/S Version: 6

Summary

Sometimes, typically on concentrators, memory issues arise. This can be seen when looking at memory statistics.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue