08-22-2017 08:58 AM - edited 03-08-2019 07:23 PM
The following error or warning occuring once or twice a day from last week why it is happen and what is the remediation shoud i take:
The number of memory pages swapped (13126) has exceeded the configured threshold (12000). For more information about this problem and how to remediate it, see the TechNote http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118881-technote-esa-00.html.
08-22-2017 02:37 PM
Hello,
You could be receiving this alert for a variety of reasons. I think the best course of action would be to open a TAC case so that an available engineer could assist with taking a closer look at the logs. At that point we should be able to provide you with a more detailed explanation of the high memory usage.
Thanks!
-Dennis M.
08-22-2017 09:24 PM
Thanks for the reply.
I am using trail of ironport (as we plan to buy it), that is why i can't create incident or support request and ask help here.
anyway thanks again.
08-23-2017 12:52 AM
Hi,
To add to what Dennis said, it would be difficult to comment on an exact cause without looking at the logs and configuration of the appliance.
It is often indicative of "expensive message filters", a result of "High memory page swapping" could mean there is an opportunity to analyze your message filters and consider alternatives for filters that utilize a large amount of RAM such as dictionaries.
Its a good idea to check how much memory the machine has using command "ipcheck".
The most common cause is from having lots of email sitting in the delivery queue that have not been delivered. The appliance requires memory to keep track of any email that is showing up as an active recipient or is in a system quarantine. If the excess memory usage is because the machine has half a million emails sitting on it, you need to identify the cause and resolve it. Once you can get the emails delivered or deleted, the memory usages will go down, and the box will perform better.
If the high memory usage is not a result of lots of emails, it gets a bit harder to identify. The next most common reasons would be from the box running lots of large emails through, or having too many connections open that are transferring large emails. In those types of cases you may want to restrict the number of connections that the box is making by setting max inbound concurrency, or destconfig settings.
Regards,
Libin Varghese
08-23-2017 02:30 AM - edited 08-25-2017 03:31 AM
Thanks liben for the explanation.
I am using 8 content filter policy with dictionary check. That might casuse the problem. Last couple of days the warning is not appearing... so might problem is resolved.
May be once i got id to log SR to cisco i will ask for full review.
Thanks again for the support.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide