Runtime Monitoring issues - Amazon GuardDuty
My Amazon Step Functions workflow is failing unexpectedlyTroubleshooting out of memory error
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Runtime Monitoring issues

My Amazon Step Functions workflow is failing unexpectedly

If the GuardDuty container contributed to the workflow failure, see Troubleshooting coverage issues. If the issue persists, then to prevent the workflow failure because of the GuardDuty container, perform one of the following steps:

  • Add the GuardDutyManaged:false tag to associated Amazon ECS cluster.

  • Disable the automated agent configuration for Amazon Fargate (ECS only) at the account level. Add the inclusion tag GuardDutyManaged:true to the associated Amazon ECS cluster that you want to continue monitoring with the GuardDuty automated agent.

Troubleshooting out of memory error in Runtime Monitoring (Amazon EC2 support only)

This section provides the troubleshooting steps when you experience out of memory error based on the CPU and memory limit to deploy the GuardDuty security agent manually.

If systemd terminates the GuardDuty agent because of the out-of-memory issue and you evaluate that providing more memory to the GuardDuty agent is reasonable, you can update the limit.

  1. With the root permission, open /lib/systemd/system/amazon-guardduty-agent.service.

  2. Find MemoryLimit and MemoryMax, and update both the values.

    MemoryLimit=256MB
MemoryMax=256MB

  3. After updating the values, restart the GuardDuty agent by using the following command:

    sudo systemctl daemon-reload
sudo systemctl restart amazon-guardduty-agent

  4. Run the following command to view the status:

    sudo systemctl status amazon-guardduty-agent

    The expected output will show the new memory limit:

    Main PID: 2540 (amazon-guardduty)
Tasks: 16
Memory: 21.9M (limit: 256.0M)