Probe memory error

[vclement]

Hi Security Onion community,

I have an error with my sensor. It works well for a few days and then the sensor stop working.
I can see that the memory is full, also there is a memory error in java (screenshot attached).

I try to change the heap size for elasticsearch according to Securityonion documentation.

[dougburks]

From #1720:

Please include the following details where you can:

• Security Onion version as seen in the lower left corner of SOC and in /etc/soversion. For example: 2.3.140
• Is this a cloud deployment or on-prem? If on-prem, do you have Internet access or this an airgap installation?
• Did you install from our Security Onion ISO image or did you perform a network installation?
• If network installation, did you install on CentOS 7 or Ubuntu?
• How many nodes do you have?
• What are the hardware specs of each of those nodes?
• How are each of those nodes configured? (ex. manager with 2 search nodes and 3 forward nodes)

[vclement]

Sorry i forgot to add the details,
--> Security Onion version : 2.3.180 but know I upgrade to 2.3.181
--> this is on-prem deployment with internet access
--> I used the Security Onion ISO.
--> I have one node (all in one server, collection and database)
--> processor: intel xeon E5506 ; memory: 16GB; Harddrive of 500GB;
Here is a screenshot from htop:

[dougburks]

From https://docs.securityonion.net/en/2.3/hardware.html#standalone-deployments:

In a standalone deployment, the manager components and the sensor components all run on a single box, therefore, your hardware requirements will reflect that. You’ll need at minimum 16GB RAM, 4 CPU cores, and 200GB storage. At the bare minimum of 16GB RAM, you would most likely need swap space to avoid issues.