cancel
Showing results for 
Search instead for 
Did you mean: 
rbarboza
Level 7

Duplicate event in monitor dlp

Hi everyone

My problem is: I see in dlp monitor many duplicate event where the time, Event Generated Time, Event Type  , Agent Action(s), only diference ID and this ocurrend with many users.

I attach a capture screen

DLP 9.2.PNG

0 Kudos
4 Replies
virgona
Level 9

Re: Duplicate event in monitor dlp

Are the evidences same?

0 Kudos
rbarboza
Level 7

Re: Duplicate event in monitor dlp

Hi Virgona,

Yes, the evidences are same

0 Kudos
emmaw
Level 7

Re: Duplicate event in monitor dlp

We have the same issue here.

0 Kudos
hagier
Level 7

Re: Duplicate event in monitor dlp

We have same issue, but we also have many errors in eventparser.log:

20140429151423    E    #02724    EVNTPRSR    source\server.cpp(1224): COM Error 0x80040E57, source=(null), desc=(null), msg=IDispatch error #3159

20140429151423    E    #02432    HOSTDLPEVENT    Error processing event: Arithmetic overflow error converting IDENTITY to data type int.

20140429151423    E    #02432    EVNTPRSR    source\server.cpp(1224): COM Error 0x80040E57, source=(null), desc=(null), msg=IDispatch error #3159

20140429151423    E    #02432    EVNTPRSR    source\server.cpp(1291): Failed to process file C:\PROGRA~2\McAfee\EPOLIC~1\DB\Events\18ccacb9-29b0-46f0-9538-f079717e1d1d-201404291459479152262000010F4.xml.

20140429151423    E    #02256    HOSTDLPEVENT    Error processing event: Arithmetic overflow error converting IDENTITY to data type int.

20140429151423    E    #02256    EVNTPRSR    source\server.cpp(1224): COM Error 0x80040E57, source=(null), desc=(null), msg=IDispatch error #3159

Thousands of these. We checked database errors and this is what we found:

2014-04-29 15:02:06.04 spid113     The Database ID 5, Page (1:4034991), slot 0 for LOB data type node does not exist. This is usually caused by transactions that can read uncommitted data on a data page. Run DBCC CHECKTABLE.

2014-04-29 15:02:36.56 spid109     Error: 7105, Severity: 22, State: 12.

2014-04-29 15:02:36.56 spid109     The Database ID 5, Page (1:4034991), slot 0 for LOB data type node does not exist. This is usually caused by transactions that can read uncommitted data on a data page. Run DBCC CHECKTABLE.

2014-04-29 15:04:06.45 spid118     Error: 7105, Severity: 22, State: 12.

2014-04-29 15:04:06.45 spid118     The Database ID 5, Page (1:4034991), slot 0 for LOB data type node does not exist. This is usually caused by transactions that can read uncommitted data on a data page. Run DBCC CHECKTABLE.

2014-04-29 15:04:09.01 spid75      Error: 7105, Severity: 22, State: 12.

After looking problem solution on McAfee pages I found one information about DLP having problem with moving events to Debug folder. Checked it and yes, they're moving like... hundred of thousands.

Can you check it's the same issue?

0 Kudos