cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3786
Views
11
Helpful
4
Replies

memory pages swapped

rockbd
Level 1
Level 1

The following error or warning occuring once or twice a day from last week why it is happen and what is the remediation shoud i take:

The number of memory pages swapped (13126) has exceeded the configured threshold (12000). For more information about this problem and how to remediate it, see the TechNote http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118881-technote-esa-00.html.

4 Replies 4

dmccabej
Cisco Employee
Cisco Employee

Hello,

 

You could be receiving this alert for a variety of reasons. I think the best course of action would be to open a TAC case so that an available engineer could assist with taking a closer look at the logs. At that point we should be able to provide you with a more detailed explanation of the high memory usage. 

 

Thanks!

-Dennis M.

Thanks for the reply.

 

I am using trail of ironport (as we plan to buy it), that is why i can't create incident or support request and ask help here.

anyway thanks again.

Libin Varghese
Cisco Employee
Cisco Employee

Hi,

 

To add to what Dennis said, it would be difficult to comment on an exact cause without looking at the logs and configuration of the appliance.

 

It is often indicative of "expensive message filters", a result of "High memory page swapping" could mean there is an opportunity to analyze your message filters and consider alternatives for filters that utilize a large amount of RAM such as dictionaries.

 

Its a good idea to check how much memory the machine has using command "ipcheck".

The most common cause is from having lots of email sitting in the delivery queue that have not been delivered. The appliance requires memory to keep track of any email that is showing up as an active recipient or is in a system quarantine. If the excess memory usage is because the machine has half a million emails sitting on it, you need to identify the cause and resolve it. Once you can get the emails delivered or deleted, the memory usages will go down, and the box will perform better.

 

If the high memory usage is not a result of lots of emails, it gets a bit harder to identify. The next most common reasons would be from the box running lots of large emails through, or having too many connections open that are transferring large emails. In those types of cases you may want to restrict the number of connections that the box is making by setting max inbound concurrency, or destconfig settings.

 

Regards,

Libin Varghese

Thanks liben for the explanation.

 

I am using 8 content filter policy with dictionary check. That might casuse the problem. Last couple of days the warning is not appearing... so might problem is resolved.

 

May be once i got id to log SR to cisco i will ask for full review.

 

Thanks again for the support.