"DDAN Critical Alert - Virtual Analyzer Stopped" error message appears in Deep Discovery Analyzer (DDAN) 5.8

This issue may indicate a larger problem and should be further investigated by the DDAN administrator. In situation in which you have received very few of such messages over a long period of time, the error can be disregarded.

However, in some cases if the issue is repeatedly happening or on multiple VMs, the sample analysis process may be halted, causing the queue to grow rapidly.

Recommended Action(s)

Trend Micro is currently investigating a permanent resolution for the issue, but in the interim does have a verified workaround which includes adjusting the DDAN configuration to change a couple of key variables.

The following two adjustments can be done by the administrator directly. If neither of the suggested two improve the situation, contact your designated Trend Micro technical support representative for further assistance.

• Option 1:

  Lower the number of Virtual Sandboxes in steps of 10%. This limits the use of the designated TMPFS space which in most cases causes the alert to trigger.

• Option 2:

  Increase the available TMPFS space by changing the setting on the DDAM RDQA page:

  1. Open your browser and enter the following address:

     https://<DDAN-IP>/pages/rdqa.php

  2. Click Change U-Sandbox Ramdisk Size and adjust the ramdisk size to maximum 24576 MB (24GB).
  3. Click Save.