Java process taking up memory on the firewall

[the_rock]

Hey guys,

Just wondering, is there a good way to troubleshoot the issue where java is taking most memory on the appliance? I noticed its always around 80% and when I run, ps -auxw, top or cpview, shows 1.5 GB free out of 8 GB and though its configured as standalone (R80.40 JHF 125), there are not too many blades enabled. So far, there are vpn, logging and status and monitoring, nothing else. If we enabled ips, IA, mobile access, memory goes up to 85% with java still taking about 20%.

Any suggestions are appreciated. I know java is usually related to CPM in this case, but just not too sure best way to go about it.

Thanks in advance!

[PhoneBoy]

Java is used for CPM, the API server, and other things.
Believe it allocates unused available memory and will back off when other things need it.

[the_rock]

Thanks D. So, just wondering, since it shows java is consuming 17% of memory, not sure where other 63% comes from, as I cant find any other processes at all consuming barely any memory.

Thoughts?

[PhoneBoy]

Kernel memory?

[the_rock]

Below is what I see...

[Expert@CPFW:0]# cpview
|------------------------------------------------------------------------------|
| CPVIEW.Overview 03Nov2021 8:13:09 |
|------------------------------------------------------------------------------|
| Overview SysInfo Network CPU I/O Software-blades Hardware-Health Advanced |
|------------------------------------------------------------------------------|
| CPU: |
| |
| Num of CPUs: 4 |
| |
| CPU Used |
| 2 7% |
| 3 4% |
| 1 2% |
| ---------------------------------------------------------------------------- |
| Memory: |
| |
| Total MB Used MB Free MB |
| Physical 7,621 6,074 1,546 |
| FW Kernel 5,639 1,005 4,634 |
| Swap 15,806 480 15,325

[the_rock]

Just to update on this...will have remote with TAC today to see what they suggest. Even after reboot, its exact same issue...fw been up for 5 mins and memory use is at 75%, with java still taking up the most.

[Timothy_Hall]

This is expected behavior.  Upon boot an SMS/MDS will probe the amount of CPUs and RAM available, and assign a resources profile that allocates the number of daemons to start and Java heap sizes among other things.  The more resources Java has the faster it can run and get useful work done as opposed to constantly doing garbage collection, so the resources profile helps ensure the full capabilities of the system hardware are being utilized without trying to take too much.  This is why the memory utilization is high immediately after a boot instead of the more typical growing slowly; it is pre-allocating the optimal amount of resources up front to ensure maximum performance and not having to grow them later.

Please see this thread which is very long but should help you understand what is going on:

Mangement server R80.10 slowness

[the_rock]

Thanks Tim. Is it normal though its constantly at 70%, not only after reboot?

[Timothy_Hall]

Maybe, what are the memory and core specs or your system and which resources profile is it using:

grep -i chosen $FWDIR/conf/serverSettings.props

[the_rock]

This is what I get:

[Expert@CPFW:0]# grep -i chosen $FWDIR/conf/serverSettings.props
CHOSEN_CPSETUP_PROFILE="Small Medium env resources profile"
[Expert@CPFW:0]#

Memory is 8 GB, so that could be part of the issue (not 100% sure) and it has 1 cpu, 2 physical cores, 4 virtual

[Timothy_Hall]

Looks right to me, I don't really see a problem here unless the system is running short of memory and routinely dipping into swap space.

[the_rock]

Thanks Tim. I think though that we will get more RAM for the customer, since it is standalone and with possibility of wanting to enable more blades down the road, its probably better to take care of this now.

Cheers.

[Timothy_Hall]

Yep, should definitely help with a standalone setup.

[kshah1]

Hi @Timothy_Hall , 

How does the Profile selection affects the memory usage. Even I am facing similar issue where the memory utilization stays at 81% on SMS which have 14 GB of RAM, SMS does not have SMARTEVENT enabled and only managing 3 firewalls as of now also, no SME in the environment. The output to above command is as below:

CHOSEN_CPSETUP_PROFILE="Large SMC env resources profile without SME"

Should we move to small to medium profile as we only have 3 gateways?

[Timothy_Hall]

Your system is probably not short on memory, please post output of "free -m".  Properly interpreting this output is included in my speech at CPX Vegas tomorrow @1:00pm and is called "Be your own TAC".

[the_rock]

I agree with that. We had an extended TAC case for a customer with this issue and turned out to be memory at the end, even esc. guy said the same.

Btw, hope recording of your presentation will be on community?

Best,

Andy

[Timothy_Hall]

Not sure if it will be recorded, but the slide deck will get posted to CheckMates for sure.

[the_rock]

Thats good enough for me...gotta learn from one of the best!

Andy