Database Management

DPA instability or crashes when SentinelOne is installed on the DPA server

In some environments, running SolarWinds Database Performance Analyzer (DPA) on the same Windows Server as SentinelOne endpoint protection has coincided with DPA becoming slow, unresponsive, or crashing. In affected cases, DPA’s Java process (Tomcat) is running with the SentinelOne Java agent injected (-agentpath:...SentinelOne\SentinelJava64.dll...), and customers see symptoms such as a “spinning” web UI, intermittent monitoring gaps, and Java crash logs (hs_err_pid####.log, heap dumps) on the DPA server. This article explains how to recognize when SentinelOne’s Java agent is injected into DPA, the types of symptoms observed, SolarWinds’ stance on antivirus/EDR configuration, and recommended next steps for customers and their security teams.

First published date

2/9/2026 4:14 PM

Last published date

2/9/2026 4:14 PM

Overview

This article describes interoperability issues observed when SolarWinds Database Performance Analyzer (DPA) runs on Microsoft Windows Server with SentinelOne endpoint protection (Windows agent) installed on the same host and injecting its Java agent into the DPA JVM.

In affected environments, customers have reported that DPA becomes very slow or unresponsive, stops collecting data intermittently, or crashes and generates Java heap dumps. DPA diagnostics in these cases show a SentinelOne -agentpath:...SentinelJava64.dll argument in the DPA JVM startup line.

The article explains how to identify when the SentinelOne Java agent is injected into the DPA process, summarizes the types of symptoms that have been seen, and outlines next steps for customers, including engaging their own security team and SentinelOne Support. It also clarifies SolarWinds’ position that we cannot provide or endorse antivirus/EDR exclusion lists or SentinelOne policy changes; any such decisions must be made by the customer’s security organization.

Product section

Database Performance Analyzer

Cause

Environment

  • Product: Database Performance Analyzer (DPA)
  • Platform: DPA installed on Microsoft Windows Server
  • Security software: **SentinelOne endpoint protection** (Windows agent) installed on the same host, with the SentinelOne **Java agent** (`SentinelJava64.dll`) injected into the DPA JVM.

    Note: All reported cases of this interoperability issue to date have involved DPA on Windows Server with the SentinelOne Windows agent. We have not observed the same pattern on Linux‑based DPA deployments so far.

  • Applies to: DPA versions that use Java/Tomcat (in particular Java 17/Tomcat 10 releases need to list release versions) when SentinelOne’s Java agent is attached to the DPA JVM

 

The issue is related to interoperability between DPA’s Java runtime and the SentinelOne Java agent when both run on the same Windows Server.

In affected environments, SentinelOne is configured so that its Java agent attaches to server‑side Java processes. When the SentinelOne Java agent is injected into the JVM that runs DPA (Tomcat), some customers have reported:

  • Loss of DPA responsiveness or “spinning” web pages
  • Intermittent repository and monitoring issues
  • Java crashes that generate `hs_err_pid####.log` files and heap dumps

    The exact behavior depends on the DPA version (Java/Tomcat level), the SentinelOne agent version, and the SentinelOne policies applied to the host. Not every environment with SentinelOne and DPA will encounter this problem, but in cases where the SentinelOne Java agent is injected into DPA’s JVM, these symptoms have been observed.

Symptoms

One or more of the following may be observed on a Windows DPA server with SentinelOne installed:

  • DPA web console issues

    • The DPA UI is very slow, then stops responding and appears to “just spin”.
    • The console may briefly work after restarting the DPA service, then becomes unresponsive again.

  • Monitoring and repository issues

    • Monitored instances show gaps in data or appear to stop collecting, even though the databases are online.
    • Repository connectivity or metric polling intermittently fails or times out.

  • Crashes and error logs on the DPA server

    • Java crash logs and dumps (for example, hs_err_pid####.log, .mdmp, or .hprof) appear in the DPA tomcat directory.
    • Crash logs may show EXCEPTION_ACCESS_VIOLATION in Java servlet–related code while DPA is running on Java 17.

  • SentinelOne Java agent injection into DPA

    • In DPA diagnostics, diagnosticSystem.log shows a JVM input argument similar to: text -agentpath:C:\Program Files\SentinelOne\Sentinel Agent\<version>\SentinelJava64.dll=extendedCapabilities
    • This indicates that the SentinelOne Java agent is attached to the JVM process that runs DPA (Tomcat).

Resolution

1. Verify whether the SentinelOne Java agent is injected into DPA

  1. Collect a DPA diagnostics bundle from the DPA web console or with assistance from SolarWinds Support.
  2. In the diagnostics archive, open:
    • diagnostic\diagnosticSystem.log
    • Search for the **JVM Input Args** section and look for a line similar to: 
      -agentpath:C:\Program Files\SentinelOne\SentinelAgent\<version>\SentinelJava64.dll=extendedCapabilities
    • If this line is present, the SentinelOne Java agent is injected into the DPA Java process.

2. Engage your internal security team

If the SentinelOne Java agent is injected into DPA:

  • Share with your security team:
    • DPA version and Windows Server version
    • The JVM Input Args section showing the SentinelOne -agentpath line
    • Any Java crash logs (hs_err_pid####.log), heap dumps, and timestamps of DPA outages
  • Ask them to review SentinelOne policies applied to the DPA host and determine whether SentinelOne may be terminating, delaying, or otherwise interfering with the DPA Java process. Often we have seen nothing in the Sentinel One logs to indicate that it is, but temporarily turning off the agent stabilizes SolarWinds DPA. 

Important: SolarWinds cannot prescribe SentinelOne configuration, exclusions, or bypass rules. Any changes to SentinelOne must be evaluated and implemented by your own security organization and/or SentinelOne Support.

3. Engage SentinelOne Support (if appropriate)

If your security team suspects SentinelOne involvement:

  • Open or update a case with SentinelOne Support and provide:
    • DPA logs and crash artifacts from the DPA server
    • SentinelOne agent version and policies in use on that host
    • Confirmation that DPA is a Java/Tomcat‑based server‑side application
  • Ask SentinelOne whether there are known issues or configuration recommendations for protecting Java server applications similar to DPA, and whether they see evidence that SentinelOne is impacting the DPA JVM.

Some customers’ security teams, working with SentinelOne, have chosen to adjust SentinelOne policies or protection levels for the DPA host. Those decisions were made by the customers’ security organizations and SentinelOne based on their own risk assessments.

 

4. Work with SolarWinds Support in parallel

While your security team and SentinelOne Support review SentinelOne configuration:

  • Open or update a case with SolarWinds DPA Support.
  • Indicate that:
    • SentinelOne is installed on the DPA server, and
    • The DPA diagnostics show a SentinelOne -agentpath entry, if applicable.
  • Attach:
    • The most recent DPA diagnostics bundle
    • Any Java crash logs and heap dumps from the DPA server

SolarWinds Support can:

  • Validate DPA configuration, sizing, and repository connectivity
  • Help correlate the timing of issues with DPA logs
  • Provide additional technical details that your security team and SentinelOne Support can use to analyze the interaction
  • This article focuses on environments where SentinelOne endpoint protection is installed on the same Windows Server that runs DPA and where the SentinelOne Java agent is injected into the DPA Java process.
  • Similar behavior may occur with other security tools that inject Java agents into server‑side Java applications. In those cases, the same general approach applies:
    • Identify whether a third‑party Java agent is attached to the DPA JVM,
    • Engage your security team and the security vendor, and
    • Work with SolarWinds Support in parallel.

What other customers’ security teams have chosen to do (examples only): In some environments, customers’ internal security teams and/or SentinelOne Support have decided to: Temporarily bypass or relax SentinelOne protection on the DPA host to see whether the behavior changes. Adjust SentinelOne policies to reduce inspection of the DPA Java process. Configure SentinelOne to exclude specific DPA components from certain checks after local testing confirmed that those changes reduced instability. In those cases: The changes were planned, tested, and approved by the customer’s own security team and SentinelOne Support

A customer reported that they had DPA more stable after using a beta SentinelOne version 25.2.3.407, including the tomcat10.exe exclusion. 

SolarWinds did not prescribe which exclusions to use, but provided relevant logs and crash artifacts to assist their analysis. These examples are provided for context only. They may not be suitable for other environments and are not recommendations.