Description

This article describes the issue of IDP signature update failure due to the Install aborted due to system reaching low memory condition! error message.

Symptoms

After an update of the IDP policy or configuration of a new IDP policy on a branch SRX device, it is not successfully updated with a new signature pack. The following messages are generated:

Operation Console 

SRX210HE>request security idp security-package install status
Done;Install aborted due to system reaching low memory condition!
Messages logs : 
Nov 2 22:14:09 srx210HE120_Spoke8 init: low_mem_signal_processes: send signal 16 to routing
Nov 2 22:14:09 srx210HE120_Spoke8 /kernel: KERNEL_MEMORY_CRITICAL: System low on free memory, notifying init (#4).
Nov 2 22:14:09 srx210HE120_Spoke8 rpd[1268]: Processing low memory signal
Nov 2 22:14:09 srx210HE120_Spoke8 init: low_mem_signal_processes: send signal 16 to idp-policy
Nov 2 22:14:09 srx210HE120_Spoke8 idpd[1295]: Processing low memory signal <
Nov 2 22:14:10 srx210HE120_Spoke8 idpd[1987]: IDP_SECURITY_INSTALL_RESULT: security package install result
Done;Install aborted due to system reaching low memory condition!)

Solution

From 11.4R6, as per the IDP compilation process enhancement, the process is stopped due to a low-memory condition.

This is a good enhancement to avoid the condition of high memory usage, which could result in the device restarting or hanging. For a customer who is running a 1GB device with a large IDP policy, this could lead to the IDP signature update failure.

To resolve this issue:


Workaround as an interim alternative to rollback this enhancement :

Turn on the disable-low-memory-handling knob (available from 11.4R6)
set security idp sensor-configuration disable-low-memory-handling
This new knob will ignore the low memory signal and allow the IDP compilation to proceed. The result could be successful or the device might hang/reboot, depending on the amount of memory being used by all of the other processes.

Example (Workaround) :

Configuration :
set security idp sensor-configuration disable-low-memory-handling
Operation :
root@srx210HE120_Spoke8> request security idp security-package install status
Done;Attack DB update : successful - [UpdateNumber=2164,ExportDate=Wed Jul 25 11:10:56 2012,Detector=12.6.160120404]
Updating control-plane with new detector : successful
Updating data-plane with new attack or detector : successful
Log :
Nov 2 22:31:43 srx210HE120_Spoke8 /kernel: KERNEL_MEMORY_CRITICAL: System low on free memory, notifying init (#5).
Nov 2 22:31:43 srx210HE120_Spoke8 init: low_mem_signal_processes: send signal 16 to routing
Nov 2 22:31:43 srx210HE120_Spoke8 rpd[1268]: Processing low memory signal
Nov 2 22:31:43 srx210HE120_Spoke8 init: low_mem_signal_processes: send signal 16 to idp-policy
Nov 2 22:31:43 srx210HE120_Spoke8 idpd[1295]: Ignoring low memory signal  <<<<<<<