Fleet management may stop responding as timestamps of the last logs received accumulate and exceed available heap memory

Fabric-enabled SIEMs connected to Fleet send a report every five minutes with the timestamp of the latest logs received from each log source. Fabric Proxy (ZooKeeper) keeps these reports for 24 hours. Every five minutes, Fleet management retrieves all 24 hours of reports from every SIEM, even though it only needs the latest one. On SIEMs with many log sources, this data can exhaust Fleet management's heap memory and cause all Fleet management endpoints to stop responding until the service is restarted manually.

If your deployment is affected by this issue, you may see the following signs:

• You cannot log in to Fleet management UI, or it becomes unavailable without a warning or error message.
• Requests to the Fleet management APIs fail or time out.
• Health and diagnosis information doesn't load in Fleet management UI. 

• If your deployment is already affected: Contact Guardsix Support to clear the stored log source reports.
• To prevent this issue: In Fleet v2.12.0 and later, monitor the heap memory usage of Fleet management. If usage approaches the limit, contact Guardsix Support to clear the stored reports before Fleet management stops responding.