Nanny process is killing sniffer

If the nanny process is killing the sniffer, you might have too much traffic coming in.

Symptoms

A message similar to the following is reported one or more times in Guardium system log (messages) or Alerts:

Nanny process error condition. The nanny process killed the sniffer. VmData was number and was over the limit.

Causes

The sniffer memory usage reached over 90% of the available memory and the nanny process has restarted it, which is expected behavior of the product.

Environment

Guardium collector

Resolving the problem

If you are observing this message frequently, there is too much traffic coming to the Guardium system. Reduce traffic to this Guardium system to resolve this message. For example, you may move some STAPs to a collector with less load, ignore some traffic in your policy, or implement load balancing to spread the traffic among more than one collector.

If the message is observed on very few occasions, it is most likely a momentary spike in traffic. To resolve the message, identify the reason for the spike and avoid the trigger. For example, you can review which processes were running at that time, identify the ones generating more traffic. If this message always coincides with a particular process or processes running, reduce the concurrent traffic at that time. For example, you can move heaviest process to run at a different time, or ignore some of this traffic through a policy.