All Apps and Add-ons

Error in 'databasePartitionPolicy': Max Raw Size Limit Exceeded

jjozwik702
Explorer

Getting Error in 'databasePartitionPolicy': Max Raw Size Limit Exceeded on the overview page of the modsecurity app when I switch to longer timeframes.

My modsecurity audit log is about 220 megs.

Anyone know what this error means and how to fix it? Haven't been able to find anything regarding the Raw Size Limit..

rsimmons
Splunk Employee
Splunk Employee

This is a known issue (SPL-93527) where search process consumes some memory and throws the following error databasePartitionPolicy - Max Raw Size Limit Exceeded

The temporary workaround for this issue is to disable the BatchSearches:
limits.conf:
[search]
allow_batch_mode = false

jjozwik702
Explorer

Additionally the server RAM spikes out when viewing most any of the overview pages.

0 Karma

jjozwik702
Explorer

From splunkd.log

06-18-2014 18:43:45.010 +0000 WARN ProcessDispatchedSearch - PROCESS_SEARCH terminate called after throwing an instance of 'std::bad_alloc'
06-18-2014 18:43:45.010 +0000 WARN ProcessDispatchedSearch - PROCESS_SEARCH what(): std::bad_alloc

Memory jumps way up.
Wondering if this should run in concurrent mod instead.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...