All Apps and Add-ons

Error in 'databasePartitionPolicy': Max Raw Size Limit Exceeded

jjozwik702
Explorer

Getting Error in 'databasePartitionPolicy': Max Raw Size Limit Exceeded on the overview page of the modsecurity app when I switch to longer timeframes.

My modsecurity audit log is about 220 megs.

Anyone know what this error means and how to fix it? Haven't been able to find anything regarding the Raw Size Limit..

rsimmons
Splunk Employee
Splunk Employee

This is a known issue (SPL-93527) where search process consumes some memory and throws the following error databasePartitionPolicy - Max Raw Size Limit Exceeded

The temporary workaround for this issue is to disable the BatchSearches:
limits.conf:
[search]
allow_batch_mode = false

jjozwik702
Explorer

Additionally the server RAM spikes out when viewing most any of the overview pages.

0 Karma

jjozwik702
Explorer

From splunkd.log

06-18-2014 18:43:45.010 +0000 WARN ProcessDispatchedSearch - PROCESS_SEARCH terminate called after throwing an instance of 'std::bad_alloc'
06-18-2014 18:43:45.010 +0000 WARN ProcessDispatchedSearch - PROCESS_SEARCH what(): std::bad_alloc

Memory jumps way up.
Wondering if this should run in concurrent mod instead.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...