Collectors are set to use 128MB of RAM by default. If your Collectors are collecting more than a few files, you should increase the max heap size the Collector can use.

To increase the maximum Java Heap size:

1.  Open install_directory/config/

2.  Add or locate the following parameter:

3. Increase the value, based on the number of files you expect to collect from.

  • 512MB for dozens of files
  • 1024MB for 100 files
  • 2048MB for more than 100 files
  • 4096MB for more than 1000 files

These are general guidelines since your exact memory requirement depends on how many sources are configured, log volume, use of wildcards and recursive scans in the path expressions, and filters.

4. Restart the collector using the command: 

install_directory/collector restart

Monitor memory issues

To monitor collectors for out-of-memory issues, ingest the collector logs, and schedule following search to run every 15 minutes with time range last 15 minutes.

_sourceCategory=*LocalCollectorLogs* "java.lang.OutOfMemoryError: Java heap space"
| timeslice 15m
| count by _timeslice, _collector
| "" as sumoHelp
| concat ("collector: ", _collector, " identified with insufficient max heap memory. Increase java heap space allocation for it. Refer: ", sumoHelp) as msg
| sort by _timeslice, _collector | fields -sumoHelp

Increase memory for collectors upgraded from versions before 19.137

If the file contains these lines: 

you must append the following to the end of the Sumo_install_dir/config/wrapper.conf file:

# Overwrite the defaults with any properties in
#include ./config/

Then update as follows:

  • Delete the above-mentioned three lines (the lines that begin with wrapper.)
  • Add the following line:<some_value>

You can now restart the Collector as described in Start or Stop a Collector Using Scripts.