IDSM2 runs at %99 memory util and

[serkan]

We have an IDSM2 on our system and runs at %99 memory 3-4 hours later after restart. It runs a few days with %99 memory util. An unknown time later Analyses engine stops and IEV didnt receive any event. After Analyses Engine stop Memory Util was going to %34 util.

Did you have an idea about this situation or should i have any control point need to be checked?

Regards,

ps. our image version is 4.1.4g

Serhat

[owillins]

If you have enabled all signatures it will lead to poor performance with high memory usage.

[jamesand]

If you have IP-logging configured then you may be hitting a known bug. Here is the workaround (AnalysisEngine will run in single processor mode):

- log into service account

- vi ~cids/idsRoot/etc/mainApp.conf

- add the following lines at the end of AnalysisEngine section:

Arg01=-t

Arg02=single

- reboot the sensor