We are running a big request using the REST API against BFI and it seems to run fine, in the tema.log we can se it reports “Completed OK” after approx 4 minutes, but then it looks like the Java process slowly extent cpu usage until the process at last becomes unresponsive and there is no other solution than to kill the process and start the application. We have found out, that this behavior can be avoided by stopping and starting the application before the request is made. Then it will report “Completed OK” after approx 4 minutes and after another 3-4 minutes it returns the result, in this case we never see the cpu above 20 percent.
The size of the result is approx 800-900 Mb.
Xmx is set to 6144m.
We do not see any javacore dumps or any errors in the tema.log.
Anyone who has seen this behavior or who has an idea why this is happening.
GET “/api/sam/v2/software_instances?criteria={“and”:[[“is_present”,”=",“1”],[“is_vulnerable”,"=",“1”],[“is_suppressed”,"=",“0”]]}&columns[]=discovery_start&columns[]=discovery_end&columns[]=computer_name&columns[]=computer_dns_name&columns[]=product_name&columns[]=component_name&columns[]=discovery_path&columns[]=product_release&columns[]=product_publisher_name&columns[]=cve.name&columns[]=cve.base_severity&columns[]=cve.base_score&columns[]=cve.source_version&columns[]=cve.publish_date&order[]=product_name&token=xxxxxxxxx&format=json"
The people requesting the data, actually needs all the data. It is gathered once a day, placed outside work hours.
As mentioned earlier, it seems to run fine, we just have to restart the BFI application before we run the query, so what is it, that is released during the restart, which makes it possible for the query to run.
As far as I can see, we are well below the advised limits mentioned in the documentation. We have approx. 12000 servers and the request extracts less than 200.000 software instances.