Out of Memory Exception in SecureApp

Overview

When removing a connection, SecureApp can perform an advanced search for connections that use the traffic you want to remove from the firewall. This "connection search" from SecureApp utilizes a large amount of system memory and if many of these searches occur simultaneously, it may cause an out of memory exception.

From R18-3 the default setting for the “connection search” option is disabled. This topic describes how to enable or disable the option for all versions.

If customers are regularly experiencing out of memory exceptions, it is recommended to disable this option. However, this should only be performed if the customer does not receive any value having this option.
Out of memory exceptions can occur for different reasons, however having the "connection search" option enabled is one of the more common reasons.

How do I do this?

Check if the connection search option is enabled or disabled

  • On the SecureChange database, run the command:

    You must provide the correct user:password values.

    kubectl exec -it deploy/sc-server -c sc-server -- curl -u user:password 
    http://localhost:8080/securechangeworkflow/api/securechange/internal/configuration/load?key=secureapp.pa.disabled | xmllint --format -

    The output includes the following:

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <configuration_change>
      <key>secureapp.pa.disabled</key>
      <currentValue>true</currentValue>
      <defaultValue>true</defaultValue>
    </configuration_change>

Disable the connection search option in SecureApp

  • On the SecureChange database, run the command:

    kubectl exec -it deploy/sc-server -c sc-server -- curl -u user:password -X PUT 
    "http://localhost:8080/securechangeworkflow/api/securechange/internal/configuration/set?key=secureapp.pa.disabled&value=true" | xmllint --format -

    The output includes the following:

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <configuration_change>
      <key>secureapp.pa.disabled</key>
      <old_value>false</old_value>
      <new_value>true</new_value>
    </configuration_change>

Enable the connection search option in SecureApp

  • On the SecureChange database, run the command:

    You do not need to restart tomcat or delete the pod.

    kubectl exec -it deploy/sc-server -c sc-server -- curl -u user:password -X PUT 
    "http://localhost:8080/securechangeworkflow/api/securechange/internal/configuration/set?key=secureapp.pa.disabled&value=false" | xmllint --format -

    The output includes the following:

    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <configuration_change>
      <key>secureapp.pa.disabled</key>
      <old_value>true</old_value>
      <new_value>false</new_value>
    </configuration_change>

References

Defining a Traffic Connection for a Request in SecureChange