Deep Security : DSM Server Memory design considerations

In the last 2 weeks I have been ask by a few clients about the memory allocation for the Deep Security Manager(DSM). There is two things to this :

  • Memory allocated the the DSM Operating system (Lets assume Windows for this blog)
  • Memory allocated to the DSM JVM

DSM Operating System Memory

Depending on you deployment size and modules that you will be using the DSM OS memory should be around 8-12Gb. The DSM service is a JVM so if you running DSM inside a VM(vs Physical server) you can consider to set reservations (I am not advocating the use of reservations…but do read up on JVM in a virtual environment).

DSM Memory configuration

The DSM JVM by default will have about 4Gb memory allocated. You can verify this in the DSM console. The Memory Metric that you looking for is “Maximum Memory. My DSM Server have 8.5Gb memory configured and as you can see only 3.56Gb available to DSM :

DSM_Mem_01

To increase the memory allocated to DSM do the following :

  • For Windows the default Installation folder is : C:\Program Files\Trend Micro\Deep Security Manager.
  • In this folder you need to create the following file : “Deep Security Manager.vmoptions” (I have tested and the case of the letters does not matter)
  • Edit the file and add the following line : -Xmx8g (Just open the file and add this line, then save..nothing more..)
  • The above will increase the Memory allocation to 8Gb memory. (If you want more just change the 8. Make sure your OS have more also)
  • Stop / Start the DSM process.

In my lab the new DSM Maximum Memory is now the following :

DSM_Mem_02

Takeaway points

  • Know that the DSM JVM memory can be increased
  • Typically when you have a lot of IPS Recommendation Scans you would increase this setting, again, based on your environment.
  • Monitor this setting. You will also see the following alerts in the DSM logs : “he DSM has reached the maximum memory that’s been allocated for the application”.
  1. What is the file format we have create inside DSM folder…..

  2. I used Windows Notepad to create and save the file. Nothing fancy on the Unicode side that needs to be done.

    Let me know if you have issues please.

Leave a Reply