Policy rollout is slow after an upgrade to SIEM 11.4.3 or later

Technical Articles ID: KB94725
Last Modified: 2023-04-13 18:54:04 Etc/GMT

Environment

SIEM Enterprise Security Manager (ESM) 11.4.5, 11.4.4, 11.4.3

Problem

After an upgrade to SIEM 11.4.3 or later, some environments have seen significant reductions in the speed at which policy rollout has occurred.

In /var/log/messages on the ESM, you see an entry similar to:

[INFO] JobThreadUnit_pol::RunPolicyRoller: Returned error: 0, Exit Code: -256, Reason: nok: Exception: getInt: null entry

Cause

In SIEM 11.4.3, a new process is added to roll out policy. This action was previously handled within cpservice internally. Under some conditions, the new process can be slower than the original one.

Any testing must be carried out by rolling out policy to multiple datasources because the new process makes extensive use of parallel processing. Rolling out policy to a single datasource is unlikely to improve in speed.

Solution 1

This issue is expected to be resolved in SIEM 11.4.6.

NOTE: Any future product functionality or releases mentioned in the Knowledge Base are intended to outline our general product direction and should not be relied on, either as a commitment, or when making a purchasing decision.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Solution 2

If an error is displayed as below:

nok: Exception: Failed to open channel: Error: Socket error: disconnected

Add the following line to /etc/NitroGuard/policyroller.rc on the ESM:

tcp_options=1

Workaround 1

Enable caching the RuleUseException table. You can enable caching by adding the following line to /etc/NitroGuard/policyroller.rc on the ESM:

cache_ruleuseexception=yes

If this action doesn’t help, open a Service Request so that we can identify all possible causes of the issue and assist you.

To create a Service Request, log on to the ServicePortal:

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields. Your password and instructions are emailed to you.

Workaround 2

As a temporary workaround, you can disable the new process so the old method of policy rollout takes effect. To disable the new process, rename the executable for PolicyRoller as shown below:

mv /usr/local/bin/PolicyRoller /usr/local/bin/PolicyRoller.backup

Affected Products

SIEM Enterprise Security Manager 11.4.x

Languages:

This article is available in the following languages:

Knowledge Center

Policy rollout is slow after an upgrade to SIEM 11.4.3 or later

Environment

Problem

Cause

Solution 1

Solution 2

Workaround 1

Workaround 2

Affected Products

Languages:

Title

Title

Knowledge Center

Policy rollout is slow after an upgrade to SIEM 11.4.3 or later

Environment

Problem

Cause

Solution 1

Solution 2

Workaround 1

Workaround 2

Affected Products

Languages:

Choose your region

Title

Title