dmoerland (Community Member) asked a question.
I am using Azure Devops to perform a 3rd party scan use Software Composition Analysis, but I keep getting the following error:
ERROR Unable to scan and generate report: Java heap space: failed reallocation of scalar replaced objects
ERROR Unable to scan and generate report: Java heap space: failed reallocation of scalar replaced objects
As noted in the title I'm sending multiple files to the Software Composition analysis scanner. The one that is failing is an Angular project. It tries running the npm scanner and then appears to just run our of memory. Any thoughts on how to fix?
_______________________________________________
Scanning completed
Found 2648 lines of code
Processing results...
Processing results complete
2020-10-22/17:03:01.784 com.sourceclear.agent.commands.ScanCommand ERROR Unable to scan and generate report: Java heap space: failed reallocation of scalar replaced objects
Scan resulted in an unexpected fatal error
.png){kind=logo}
@Jason M., Veracode Support (Veracode) Given that we don't run a Java app...I'm thinking that is your software complaining and not mine 😀 So no, I do not think this is a solution.
Hello @dmoerland (Community Member) ,
Increasing the heap size in your CI usually fixes this issue. Just keep increasing until it works. Or, you can use the below parameter as a workaround:
--skim-vms
If you are using recursive, you could turn that off. Just means your project is gigantic, or you have recurring on, so more heap space is needed. However, this will leave the vulnerable methods out, but for some customers, that is worth it to get fast results without increasing heap sizes.
Jason
Community Support Engineer
Probably there are a type in your post
instead of --skim-vms should be --skip-vms
documentation: https://help.veracode.com/r/c_sc_agent_usage
Hello @dmoerland (Community Member) ,
In order to help with the memory issue, I would suggest taking a look at the website How to deal with “java.lang.OutOfMemoryError: Java heap space” error? https://stackoverflow.com/questions/37335/how-to-deal-with-java-lang-outofmemoryerror-java-heap-space-error
If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
Jason
Community Support Engineer
Usually, this error is thrown when the Java Virtual Machine cannot allocate an object because it is out of memory, and no more memory could be made available by the garbage collector.
Therefore you pretty much have two options:
Increasing the heap sizeis a bad solution, 100% temporary. It will crash again in somewhere else. To avoid these issues, write high performance code.
The SCA cli tool (srcclr) internally uses Java to do it job and the corresponding JVM is the source of that "... ERROR Unable to scan and generate report: Java heap space ..."
As it wasmentioned, you'll need to direct the JVM's where the internal srcclr's Java process runs to be able to use more heap memory; usually is done via arguments to the "java" CLI which executes the corresponding process, but since that done internally by srcclr you can send the arguments via an environment variable:
JAVA_TOOL_OPTIONS=-Xmx8g
that sets the next JVM's Max. Heap Size 8 GB
on a Unix based OS (Linux, macOS, etc.) you can set an environment variable by prefixing it to the command:
> JAVA_TOOL_OPTIONS=-Xmx8g srcclr scan .
alternatively you can set the environment variable first and then run the srcclr command
> set JAVA_TOOL_OPTIONS=-Xmx8g
> srcclr scan .
Note that with last approach the environment variable will continue available during the shell's life (unless it's unset before).