Troubleshoot Live Backup - Administrator Guide - 6.10 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.10
Creation date
2022-10-13
Last date published
2024-10-29
End_of_Life
EoL
Category
Administrator Guide
Abstract

How to troubleshoot live backup scenarios in Cortex XSOAR.

The following are recommendations for live backup errors.

Live Backup Error Message on the Disaster Recovery Page

disaster-recovery-live-backup-error-message.PNG

This message indicates the system is in Recovery Mode and how many actions remain to be transferred before it exits Recovery Mode.

If due to connectivity issues data transfer is either slow or suspended between the live backup server and the production server, actions can accumulate on the live backup server. Once connectivity is restored, the system enters Recovery Mode until the accumulated actions are transferred.

Out of Memory Error Message

If you receive an out of memory error when live backup is enabled, consider changing the server configurations for disaster recovery.

  1. Select SettingsABOUTTroubleshootingAdd Server Configuration.

  2. Add the following configurations

    Key

    Description

    Value

    dr.batch.size

    Controls the number of actions sent to the disaster recovery server in one request. A very high value can cause memory issues. A very low value can cause performance issues, which causes the backup server to be synced slower (not in real-time).

    It is recommended to start low (25-50) and increase according to memory usage.

    Default is 300

    dr.memory.limit.mb

    Limits the memory size (in MB) of the action items, which should prevent out of memory errors.

    dr.batch.size and dr.memory.limit.db work together, so the threshold is reached when the limitation of either configuration is met.

    If you receive an out of memory error, consider reducing to 100.

    Default is 300

    dr.queue.size

    The total number of actions to keep in memory before entering recovery mode. It is recommended to keep the default number, as it is relative to the size of the dr.batch.size configuration.

    Default is 10*dr.batch.size