IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  runtime component memory usage

    Posted 03/30/21 03:35 AM
    Hi community,

    We are running IBM Security verify (actually still ISAM 9.0.7) in a docker environment and we can see that the java process in the runtime container is using lots of memory (VSZ).

    The command should be capped to 2G (Xms and Xmx both set to 2G), but we can see it using far more than those 2G and we are not sure if it is related to caching but it seems to consume quite a big chunk of the available resources of the host.

    5000      679881  677083  7 Mar29 ?        01:01:47 /opt/ibm/java-x86_64-80/jre/bin/java -javaagent:/opt/IBM/wlp/bin/tools/ws-javaagent.jar -Djava.awt.headless=true -Xms2048m -Xmx2048m -Dcom.ibm.security.enableCRLDP=true -Dsun.net.inetaddr.ttl=30 -javaagent:/opt/monitoring/jmx_prometheus_javaagent-0.12.0.jar=0.0.0.0:9090:/opt/monitoring/config.yaml -Dcom.ibm.jsse2.usefipsprovider=true -Dcom.ibm.jsse2.overrideDefaultTLS=true -Dcom.ibm.jsse2.sp800-131=transition -Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true -Dorg.osgi.framework.system.packages.extra=com.tivoli.pd.rgy,com.tivoli.pd.rgy.authz,com.tivoli.pd.rgy.exception,com.tivoli.pd.rgy.ldap,com.tivoli.pd.rgy.nls,com.tivoli.pd.rgy.util,com.ibm.misc,com.ibm.net.ssl.www2.protocol.https,com.sun.jndi.ldap -Disam.appliance=true -jar /opt/IBM/wlp/bin/tools/ws-server.jar runtime --clean

    When we issue the following command on the host (filtering on the processes from the container) we can see RSS being within the 2G limits but we see the virtual memory exeding it by a lot (11G). We are not sure if this is a problem, but are a little concerned though.

    ps -eo pmem,comm,pid,ppid,maj_flt,min_flt,rss,vsz --sort -rss | numfmt --header --to=iec --field 5-6 | numfmt --header --from-unit=1024 --to=iec --field 7-8 | column -t|egrep 'COMMAND|677083'
    %MEM  COMMAND          PID      PPID     MAJFL  MINFL  RSS   VSZ
    1.5   java             679881   677083   425    2.9M   966M  11G
    0.0   postgres         678714   677083   0      46K    20M   159M
    0.0   wga_watchdogd    678813   677083   0      232    8.8M  263M
    0.0   mesa_eventsd     678365   677083   0      75     3.3M  115M
    0.0   rsyslogd         681730   677083   0      98     2.8M  99M
    0.0   bootstrap.sh     677691   677083   0      625    2.7M  12M
    0.0   crond            678739   677083   0      1.3K   2.7M  23M
    0.0   override-docker  677083   677065   0      917    2.6M  12M
    0.0   mesa_syslogd     678407   677083   0      80     2.4M  62M
    0.0   mesa_crashd      678287   677083   0      63     1.8M  23M

    Does anybody see similar things and do you know why the VSZ is so much higher than RSS?

    Thanks in advance!

    ------------------------------
    Kristof Goossens
    ------------------------------


  • 2.  RE: runtime component memory usage

    Posted 04/01/21 07:58 AM
    Hi Kristof:
    What you are experiencing has nothing to do with ISVA, but it is related to JVM.
    When you specify the Xms and XmX, in fact, you are only specifying the amount of memory for the HEAP. JVMs do not only use HEAP memory, they also use Stack, and more.
    So, I believe what you are seeing, when running ps, is the total memory. Furthermore, the column VSZ is in fact the virtual memory size assigned to the process. The REAL memory being used is in the RSS column.

    I hope it helps.

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------



Related Content