Console performs slowly, cannot display console fields and panes, or reports do not complete in Symantec ManHunt

Article:TECH111729  |  Created: 2002-01-25  |  Updated: 2007-01-18  |  Article URL http://www.symantec.com/docs/TECH111729
Article Type
Technical Solution


Issue



When first launched, the ManHunt console takes several minutes to display any events, or the console itself is displayed with a gray border, and no fields or panes show within that border. Reports may also not complete when run, or the report may not export or print successfully.


Solution



The common causes of slow performance are low memory allocation, or a very large incident or event database. To fix a low memory problem, you can use switches with the Java command to allocate more memory to the process. To reduce the database size, rotate your log files on a regular basis or set the number of incident hours that the console displays.

One, or a combination of the steps below, will help to improve performance.


Rotating log files
Rotating log files to reduce the size of the data being queried can dramatically increase console performance. However, unless log files are routinely rotated, the positive effects are temporary. For information regarding how to rotate your log files, read How to archive ManHunt log files and How to archive logs using the ManHunt 3.0.x Console interface.


Setting incident hours displayed
ManHunt contains a configuration variable that is called incidentHours. The incidentHours variable limits the number of incidents that the console attempts to load. Reducing the number of events that the console loads increases performance, but also reduces the number of incidents in your data range.

The incidentHours variable is set locally where the console is installed (not on the ManHunt node), and thus needs to be configured on each computer that you or other administrators run the console from.

To set the incidentHours configuration variable on Solaris or Red Hat Linux
  1. Close the ManHunt console, if it is open.
  2. Navigate directly to the home of the user who installed the ManHunt console.
  3. Open the .ManhuntSetup.Properties file in a text editor such vi. (Note that .ManHuntSetup.Properties is a hidden file.)
  4. Add the following line to the end of the file:

    incidentHours=<# of hours>

    where the <# of hours> is any integer.

    Be sure that incidentHours is spelled exactly as shown (lower case "i" and a capital "H"). Setting the number of hours to zero results in an unlimited number of events displayed by the console.

Symantec recommends that you initially set the number of hours to a fairly low number (such as 24 or 48). This will resolve the problem. From that point, you can gradually increase the number of hours until you find a value that is just below the number of hours that will cause the problem to recur.

To set the incidentHours configuration variable on Windows 2000 or XP
  1. Close the ManHunt console if it is open.
  2. Open the .ManhuntSetup.Properties file in a text editor such Notepad. This file is located in the user profile directory of the user who installed the console. For example, C:\Documents and Settings\\
  3. Add the following line to the end of the file:

    incidentHours=<# of hours>

    where the <# of hours> is any integer. Be sure that incidentHours is spelled exactly as shown (lower case "i" and a capital "H"). Setting the number of hours to zero results in an unlimited number of events displayed by the Console.

Symantec recommends that you initially set the number of hours to a fairly low number (such as 24 or 48). This resolves the problem. From that point, you can gradually increase the number of hours until you find a value that is just below the number of hours that causes the problem to recur.

    Launching the console with Java options
    To allocate more memory to the console, use the following steps, depending on the operating system of the console that you are using.

    To launch the console on Windows with the Java options
    1. Click Start > Run.
    2. In the Run box, type cmd and click OK. A command prompt appears.
    3. Navigate to the ManHunt Console directory by typing cd and the path to the directory. For example, if the directory is in the default location, type the following:
      cd c:\progra~1\symantec\manhunt
    4. Type the following to launch the console by using the Java option of a maximum memory allocation of 256 MB. You can adjust the value to reflect the amount of memory that you want to allocate.
      • If Java v1.4 is installed in its default directory, type:
        c:\progra~1\java\j2rel.4.0_02\bin\java -Xmx256m -jar mhadmin.jar
      • If Java v1.4 is not installed in its default directory, make changes as necessary to the path just given.
    To launch the console with these options each time that you open it, type the command above, with the modifications necessary for your installation and memory needs, into the Target field of the ManHunt console shortcut Properties.

    To launch the console on Solaris or Red Hat Linux
    At a terminal window, type the following to launch the console with the Java option setting a maximum memory allocation of 256 MB. You can adjust these values to reflect the amount of memory that you want to allocate.
      • If Java v1.4 is installed in its default directory, type:
        /usr/manhunt/bin/java -Xmx256m -jar /usr/manhunt/java/mhadmin.jar
         
      • If Java v1.4 is not installed in its default directory, make changes as necessary to the path just given.



    References
    For more information on the memory allocation options that available for use with Java, read the "Recommended java memory flag" section on page 318 of the Symantec ManHunt 3.0 R2 Administration Guide and Big Heaps and Intimate Shared Memory (ISM),




    Technical Information
    In Java, the -xmx command specifies the maximum amount of memory (heap) to be made available to the Java Virtual Machine (JVM). For instance, -Xmx256m starts the JVM and limits that JVM heap size to 256 megabytes.


    The - xms command specifies the initial heap size.



    Legacy ID



    2002102515522653


    Article URL http://www.symantec.com/docs/TECH111729


    Terms of use for this information are found in Legal Notices