cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Level 12
Report Inappropriate Content
Message 1 of 10

ESM & Receiver Disk space errors

Hi Friends,

We are receiving alerts from ESM & receiver for high memory consumption and it's fluctuation on a daily basis.

we have separate database server for logging also, Can anybody give us some suggestion and whats the reason for the issue??

Thanks in advance

Regards,

kotresha

9 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: ESM & Receiver Disk space errors

Sorry, not sure without a fair bit more data. For something like this I would recommend upgrading to 9.6, waiting a day, and if it isn't fixed then contact support.

Highlighted
Level 12
Report Inappropriate Content
Message 3 of 10

Re: ESM & Receiver Disk space errors

Thanks for the response andy, we are using 9.5.0 version, what details you require??

Highlighted
Level 12
Report Inappropriate Content
Message 4 of 10

Re: ESM & Receiver Disk space errors

Can anybody help me with this??

Highlighted
Level 12
Report Inappropriate Content
Message 5 of 10

Re: ESM & Receiver Disk space errors

Hi,

i think you should write a Service request for this Problem. But the Service desk will say upgrade to 9.6.0.

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 10

Re: ESM & Receiver Disk space errors

Were you able to upgrade to 9.6? There is a memory management issue that is addressed in 9.5.2.

Highlighted
Level 12
Report Inappropriate Content
Message 7 of 10

Re: ESM & Receiver Disk space errors

Capture.PNG

Capture1.PNG

Here the more details about the issue, even though shared memory is available we are getting alerts.

any help would be appreciated.

Regards,

KMC

Highlighted

Re: ESM & Receiver Disk space errors

KMC,

We've just gone through a few of these issues, you definitely want to call in an SR, this will impact your event collection and logging and can snowball quickly.

Rick

Re: ESM & Receiver Disk space errors

First of all, you need to check the EPS by creating an alarm that will be triggered when EPS exceeds the limit, if you have that case this will be the reason why we have this issue.

Good luck.

Highlighted

Re: ESM & Receiver Disk space errors

There are two different part of problems:

Receiver high memory:

-      Can you see logs coming out from the Datasources

-  Generally, if the receiver disk space goes high then there could be two problems. Either receiver is having communication problem with the ELM to send raw logs or the services of receiver are getting

impacted i.e parsing of the events is not happening, which is causing whole disk space to go high.

- Check if you are able to SSH directly from ESM to Receiver and Receiver to ELM

- Check if there is any lag in processing of events from Receiver's side.

- Ultimately, its better to contact TAC, who can help in isolating the actual cause of problem.

ESM high memory:

- There is a lot of data present in "/"

- Perform:

cd /

du -chx | grep "[0-9]G"

- You need to check with the device health for this issue.

It might be having some database issues/corruptions which are causing the memory to go high.

Recently, cpservice restart actually addressed the memory consumption issue. But all this is suggested under expert supervision.

Any modification or deletion may create big impact on ESM data storage.

They might suggest you upgrade to 9.5.2 (atleast) for stable behavior.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community