COUNT DISTINCT aggregate on PA indicators may lead to high memory consumption for Vulnerable Items collection - Known Error

COUNT DISTINCT aggregate on PA indicators may lead to high memory consumption for Vulnerable Items collection Description COUNT DISTINCT aggregate on PA indicators may lead to high memory consumption for Vulnerable Items collection.

Steps to Reproduce

Enable the Performance Analytics for Vulnerability Response in the instance. Add up to 3-4M entries for Vulnerable Items with about 18,000+ distinct CIs. 2. With the OOB configuration, there are at least 3 OOB indicators with Aggregate Count distinct on-field "Configuration Item". 3. Add up to 10 breakdowns to this indicator (OOB you might already have this set up). 4. Add these indicators to a daily collection job and execute.

As a result, while in "Applying map/reduce function" of the indicator source processing, the application node running that job will run out of memory or will cause semaphore exhaustion.

Workaround This problem is under review and targeted to be fixed in a future release. To receive notifications when more information becomes available, subscribe to this Known Error article by clicking the Subscribe button at the top right of this form.

The workaround is to attempt decreasing the number and complexity of records that need to be processed in a single job:

- Disable the Breakdown Matrix for any COUNT DISTINCT Indicators that have more than 100k distinct values (e.g. CIs). - Ensure at least one Indicator on the Indicator Source has no conditions. If there is none, move conditions from the Indicator to the Indicator source. - Break apart large Indicator Source with multiple Indicators per job into separate job if they are using a COUNT DISTINCT or Collecting Records or there are large number of scores.