Cisco ESA The overall memory swap usage (11%) has exceeded the configured threshold value of 10%.

[ccna_security]

Dear all. today i get such a message (The overall memory swap usage (11%) has exceeded the configured threshold value of 10%.  ) from ESA very often. could you please tell me what kind of issue it is? thanks in advance

[ppreenja · Accepted solution]

Hi,

The swap alert received is informational alert. The system is designed to swap memory regularly, so some memory swapping is expected and is not an indication of problems with your appliance. Unless the system consistently swaps memory in high volumes, memory swapping is normal and expected behavior.

In order to stop such alerts, you can change the threshold value for the Memory Page swapping alert by following the below steps:

Log in to GUI-->System Administration-->System Health-->Edit Settings-->Memory Page swapping (Set the new threshold value, submit and commit the changes).

If the swap alert received the highest percentage the appliance generated is 11%, you can change the threshold to 15% after which won't receive any further alerts.

Cheers,
Pratham

[ccna_security]

Thank you so much

[Wolfgang.Berghold]

Hi,
thanks for this kind of solution, I increased the value already some times and currently I´m at 30% and alerts still started again. 

Fri Dec 23 10:19:47 2022 : The overall memory swap usage (32%) has exceeded the configured threshold value of 30%.

Any else solutions? Or just increasing the alert value? We are already in planning to renew the appliances, I just want to get sure that no issue is expected.
Thanks in advance and regards

Wolfgang

[Ken Stieers]

Check your content filters and any dictionaries they reference for recently added regexes that are greedy.