Cortex XDR memory consumption and management on Linux

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Cortex XDR memory consumption and management on Linux

L1 Bithead

Hello team,

 

I have query regarding Cortex XDR Linux agent memory consumption and management.

 

We have seen multiple cases where Cortex XDR memory consumption is high, however whenever we raise a case we got to know that memory consumption is normal. 

 

I would like to know what is the idle consumption for Cortex XDR agent in linux OS?

 

How Cortex XDR agent manages virtual (VSS) and resident memory(RSS) allocation in linux? As virtual memory consumption looks huge multiple time while checking the consumption.

 

Thanks in advance !!

 

Cortex XDR 

6 REPLIES 6

L4 Transporter

Hello @tejaspatil12 

 

Thanks for reaching out on LiveCommunity!

We cannot provide idle memory consumption for XDR agent because it varies from environment to environment. Regarding memory allocation, Resident memory is the actual physical memory used by the process, while virtual memory means that the os reserved pages for the process. In pmd's case, most of those pages are not used. The sum of resident memory of all processes should not exceed the systems total available RAM while virtual memory can easily exceed the total RAM. Thus, the relevant metric for memory pressure is usually the resident memory.

 

Note: If memory consumption is consistently high please open the TAC case to find the root cause.

 

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Hello @nsinghvirk ,

 

Thanks for clarity on these.

 

1 more query regarding the same :-

 

If virtual memory is used by process pmd is not used then when it gets released by Cortex XDR. As increased consumption of these virtual memory is also issue right?

L0 Member

Hi please, I need your comments. 

 

We have a server linux CentOS 7, with 2CPU, 40GB HardDisk and 4GB RAM. 

The agent version is 8.1.1.112729

 

The RAM usage for the agent it's 2GB. We can limit RAM usage for Cortex processes??

Or what is your recommendations?

 

Best regards, 

 

L4 Transporter

Hello @DanielaMorales 

 

Thanks for reaching out on LiveCommunity!

The specification required for Cortex XDR agent version 8.1 are given below.

REQUIREMENT

MINIMUM SPECIFICATION

Processor

Processor 2.3 GHz dual-core processor

RAM

4GB; 8GB recommended

Hard disk space

10 GB

 

Hence please follow the minimum specification of 4GB RAM for proper working of agent. To know more about cortex xdr agent requirements for linux operating system please follow below document.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.1/Cortex-XDR-Agent-Administrator-Guide/Corte...

 

 

Hi Nsinghvirk,

Thank you for your comments, I am very clear about the minimum and recommended requirements for the version 8 agent.
What remains in my doubt is whether with 4GB of RAM the available memory can be considered very limited? Considering that pmd's processes Cortex are taking up 2 GB. Can memory use be limited for Cortex processes? Or how can I check why Cortex is using so much memory to analyze?

 

Regards, 

 

L4 Transporter

Hello @DanielaMorales 

 

There is no inbuilt memory limiting feature available with Cortex XDR. We do not recommend to limit the memory for XDR as it will impact its protection capabilities. 4GB is given as a minimum specification with 8GB being the recommended RAM requirement. If you are observing high memory usage by XDR please open a TAC case because they will be able to analyse the memory consumption logs and will help you to reduce the usage.

  • 807 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!