Cortex XSOAR may show incorrect memory usage when using Go lang v.1.12 and above

Cortex XSOAR may show incorrect memory usage when using Go lang v.1.12 and above

0
Created On 11/19/20 19:10 PM - Last Modified 07/19/22 23:19 PM


Symptom


In Go Lang version 1.12 and above, on Linux machines, runtime uses MADV_FREE to release unused memory, which may result in a higher reported RSS. In some monitoring systems, Cortex XSOAR (version 5.5 and above) may show that it is consuming more memory than it actually is.

NOTE: When upgrading, you need to perform this procedure again as the changes made are overridden by the upgrade.

Environment


  • Cortex XSOAR (version 5.5 and above)
  • Go Lang version 1.12 and above, on Linux machines

Resolution


To show the correct usage:
  1. Open the Cortex XSOAR service file by going to /etc/systemd/system/demisto.service.
  2. In the [Service] section add the following line:
Environment="GODEBUG=madvdontneed=1"

For example, the Cortex XSOAR service file should look like this:

Cortex XSOAR service file
 
  1. Type the following commands:
    1. sudo systemctl daemon-reload
    2. sudo service demisto restart
Suggested Note: Using the above configuration might cause performance degradation. We suggest to use it only to check if this is the root cause of high memory usage, and then you can revert it.
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBhvCAG&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail