Server RAM Full Usage and stop service

[talaee71 0]

hi 

My Server (ESET Protect Server) fills all of my server RAM after 3 hours and then shuts down the service automatically

I tried many ways including:
1- Disconnect the modules Eset File Security
2- Cleaning the software Eset File Security
3- Add server RAM up to 32 GB

Please Help us

thanks

[Marcos 5,274]

Please check hw sizing at https://help.eset.com/protect_install/80/en-US/hw_requirements.html if it fits your environment.

How many clients connect to the ESET PROTECT server?
What type of db is used?
Is the db on the same or another separate server?
What is the hw configuration of the server(s)?
What is the disk IOPs on the server(s)?
Are any other resource-intensive services running on the server(s)?
Did you apply any extra policy on clients, such as a Web Control rule that logs all visited websites?

[talaee71 0]

yes i check that link before and My hardware resources are much more than these minimums

How many clients connect to the ESET PROTECT server?

1500 clients

What type of db is used?

i used Microsoft SQL server enterprise 

Is the db on the same or another separate server?

separate server

What is the hw configuration of the server(s)?

for db server i set 32gb ram and 4 core cpu

for eset server i set 32gb ram and 8 core cpu 
What is the disk IOPs on the server(s)?

db disk IOPs is : unlimited - SSD

ESMC Disk IOPs is : unlimited - SSD

Are any other resource-intensive services running on the server(s)?

no just Eset Enterprise Server Agent 

Did you apply any extra policy on clients, such as a Web Control rule that logs all visited websites?

No, I Double Check Now And No Extra Logs set in policy's

 

[Marcos 5,274]

Please open a ticket with your local ESET distributor. We'll need you to set trace logging verbosity and provide at least 3 EP Server process dumps as the memory consumption grows for perusal.

[MichalJ 434]

@talaee71 are you using as well Enterprise inspector server? As that might have some impact on the ESET PROTECT performance as well.

[talaee71 0]

Dear Marcos

Thanks for the reply
Please help me where to go to open the ticket

3 hours ago, Marcos said:

Please open a ticket with your local ESET distributor. We'll need you to set trace logging verbosity and provide at least 3 EP Server process dumps as the memory consumption grows for perusal.

Also please explain if there is anything I can do

[talaee71 0]

3 hours ago, MichalJ said:

@talaee71 are you using as well Enterprise inspector server? As that might have some impact on the ESET PROTECT performance as well.

Yes we use Enterprise Inspector server.
How can I prevent this kind of effect?

[Marcos 5,274]

Is the EEI server installed and running on a different server than ESET PROTECT? I assume so since you mentioned that no other resource-intensive service is running on the server but asking just to make sure. Also what about the EEI db? Is it on a separate server as well?

As for a support ticket, you seem to be from UK so please contact ESET UK: https://www.eset.com/uk/

[talaee71 0]

24 minutes ago, Marcos said:

Is the EEI server installed and running on a different server than ESET PROTECT? I assume so since you mentioned that no other resource-intensive service is running on the server but asking just to make sure. Also what about the EEI db? Is it on a separate server as well?

As for a support ticket, you seem to be from UK so please contact ESET UK: https://www.eset.com/uk/

Yes EEI server and EEI db server install on different server 

For db EEI set 128gb ram and 8 cors cpu and for EEI server i set 32gb ram and 4 cores cpu

Generally i have 4 servers 

2 servers for ESMC and DB 

2 servers for EEI server and DB 

[MartinK 384]

Most probable reason for this behavior is that EP is receiving much more data, that it is able to handle (write to database) - could you possible check performance dashboard for "pending logs"? Also were there any changes in configuration of your environment that could possibly result in much more data generated? For example changes in various detection methods and especially reporting, or maybe changes in EEI rules (filtered websites, firewall, webcontrol)? Any change there is some degradation on DB layer which might be no longer able to handle data processed by EP?
Also is it possible to check basic sizing report of EP database to find out whether there are no database tables that are much more than others (i.e. millions of entries). Also status.html log of your EP instances might helps, as it provides both basic and detailed statistics of data received from clients, but it does not includes EEI data.

Second reason for huge memory consumption might be leaking of network connections, i.e. very often re-opening new connections from AGENTs to EP, without proper closing - but this was not encountered very often, it might indicate some connectivity problems, where some network components might be interfering and preventing AGENTS to open persistent connections: in order to check this, please check how many open connections is actually EP handling as of now.

In case it is possible and growth of memory is fast, maybe temporary disabling EEI->EP connectivity might help to at least pin-point source of the issues/data that is most probably just not processed in time.