IBM Support

IV84736: TOMCAT OUT OF MEMORY CAN OCCUR CAUSING THE USER INTERFACE TO BECOME INACCESSIBLE

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • It has been observed that the JMS Message cache in Memory can
cause Tomcat to go Out of Memory when messages can't be posted
to the queue.
This particular instance was determined to be caused by a large
number of open ports on a single host reported by scanner data.

Messages similar to the following might be visible in
/var/log/qradar.log when this issue is occurring:

[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse] Caused by:
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse] com.sun.messaging.jms.JMSException:
[C4095]: Message exceeds the single message size limit for the
broker or destination: VisTopicRESPONSE user=qradar,
broker=127.0.0.1:7676(7677)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.ProtocolHandler.writeJMSMessage(
ProtocolHandler.java:1958)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.WriteChannel.sendWithFlowControl
(WriteChannel.java:173)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.WriteChannel.writeJMSMessage(Wri
teChannel.java:126)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.Transaction.send(Transaction.jav
a:510)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.SessionImpl.writeJMSMessage(Sess
ionImpl.java:776)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.MessageProducerImpl.writeJMSMess
age(MessageProducerImpl.java:207)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.MessageProducerImpl.writeJMSMess
age(MessageProducerImpl.java:196)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.MessageProducerImpl.send(Message
ProducerImpl.java:628)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.q1labs.frameworks.session.FrameworksMessageProducer$SendComm
andD.execute(FrameworksMessageProducer.java:288)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.q1labs.frameworks.session.FrameworksMessageProducer.flush(Fr
ameworksMessageProducer.java:440)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.q1labs.frameworks.session.FrameworksJMSSession.commit(Framew
orksJMSSession.java:166)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.q1labs.frameworks.session.SessionContext.commitTransaction(S
essionContext.java:1000)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    ... 31 more

Local fix

  • Contact Support for a possible workaround that might fix this
issue in most instances.

Problem summary

  • It has been observed that the JMS Message cache in Memory can
cause Tomcat to go Out of Memory when messages can't be posted
to the queue.
This particular instance was determined to be caused by a large
number of open ports on a single host reported by scanner data.

Messages similar to the following might be visible in
/var/log/qradar.log when this issue is occurring:

[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse] Caused by:
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse] com.sun.messaging.jms.JMSException:
[C4095]: Message exceeds the single message size limit for the
broker or destination: VisTopicRESPONSE user=qradar,
broker=127.0.0.1:7676(7677)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.ProtocolHandler.writeJMSMessage(
ProtocolHandler.java:1958)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.WriteChannel.sendWithFlowControl
(WriteChannel.java:173)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.WriteChannel.writeJMSMessage(Wri
teChannel.java:126)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.Transaction.send(Transaction.jav
a:510)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.SessionImpl.writeJMSMessage(Sess
ionImpl.java:776)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.MessageProducerImpl.writeJMSMess
age(MessageProducerImpl.java:207)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.MessageProducerImpl.writeJMSMess
age(MessageProducerImpl.java:196)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.sun.messaging.jmq.jmsclient.MessageProducerImpl.send(Message
ProducerImpl.java:628)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.q1labs.frameworks.session.FrameworksMessageProducer$SendComm
andD.execute(FrameworksMessageProducer.java:288)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.q1labs.frameworks.session.FrameworksMessageProducer.flush(Fr
ameworksMessageProducer.java:440)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.q1labs.frameworks.session.FrameworksJMSSession.commit(Framew
orksJMSSession.java:166)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    at
com.q1labs.frameworks.session.SessionContext.commitTransaction(S
essionContext.java:1000)
[tomcat] [configservices@127.0.0.1 (4250) /console/JSON-RPC
System.postScanResponse]    ... 31 more

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.3.0

Temporary fix

  • 



Comments


    

  • 



APAR Information




    

  • APAR number
    IV84736
    • 

  • Reported component name
    QRADAR SOFTWARE
    • 

  • Reported component ID
    5725QRDSW
    • 

  • Reported release
    726
    • 

  • Status
    CLOSED  PER
    • 

  • PE
    NoPE
    • 

  • HIPER
    NoHIPER
    • 

  • Special Attention
    NoSpecatt / Xsystem
    • 

  • Submitted date
    2016-05-12
    • 

  • Closed date
    2017-04-11
    • 

  • Last modified date
    2017-04-11
    • 





    

  • APAR is sysrouted FROM one or more of the following:
    

    • 

  • APAR is sysrouted TO one or more of the following:
    

    • 



Fix information


    

  • Fixed component name
    QRADAR SOFTWARE
    • 

  • Fixed component ID
    5725QRDSW
    • 



Applicable component levels


    

  • R730  PSY
       UP
    • 








      
          
                    

          

          [{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"726","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
          

                    

        
        

        

      


      


        

            

            
Document Information


            

            


                        

            Modified date:
            

            11 April 2017
            

            
            
          

        


        

        


      


    


  





    

  



  
    
      

      
Page Feedback