4 Replies Latest reply: Apr 29, 2014 8:20 AM by hagier RSS

    Duplicate event in monitor dlp

    rbarboza

      Hi everyone

       

      My problem is: I see in dlp monitor many duplicate event where the time, Event Generated Time, Event Type  , Agent Action(s), only diference ID and this ocurrend with many users.

       

       

      I attach a capture screen

       

      DLP 9.2.PNG

        • 1. Re: Duplicate event in monitor dlp
          virgona

          Are the evidences same?

          • 2. Re: Duplicate event in monitor dlp
            rbarboza

            Hi Virgona,

             

            Yes, the evidences are same

            • 3. Re: Duplicate event in monitor dlp
              emmaw

              We have the same issue here.

              • 4. Re: Duplicate event in monitor dlp
                hagier

                We have same issue, but we also have many errors in eventparser.log:

                 

                20140429151423    E    #02724    EVNTPRSR    source\server.cpp(1224): COM Error 0x80040E57, source=(null), desc=(null), msg=IDispatch error #3159

                20140429151423    E    #02432    HOSTDLPEVENT    Error processing event: Arithmetic overflow error converting IDENTITY to data type int.

                20140429151423    E    #02432    EVNTPRSR    source\server.cpp(1224): COM Error 0x80040E57, source=(null), desc=(null), msg=IDispatch error #3159

                20140429151423    E    #02432    EVNTPRSR    source\server.cpp(1291): Failed to process file C:\PROGRA~2\McAfee\EPOLIC~1\DB\Events\18ccacb9-29b0-46f0-9538-f079717e1d1d-2014 04291459479152262000010F4.xml.

                20140429151423    E    #02256    HOSTDLPEVENT    Error processing event: Arithmetic overflow error converting IDENTITY to data type int.

                20140429151423    E    #02256    EVNTPRSR    source\server.cpp(1224): COM Error 0x80040E57, source=(null), desc=(null), msg=IDispatch error #3159

                 

                Thousands of these. We checked database errors and this is what we found:

                 

                2014-04-29 15:02:06.04 spid113     The Database ID 5, Page (1:4034991), slot 0 for LOB data type node does not exist. This is usually caused by transactions that can read uncommitted data on a data page. Run DBCC CHECKTABLE.

                2014-04-29 15:02:36.56 spid109     Error: 7105, Severity: 22, State: 12.

                2014-04-29 15:02:36.56 spid109     The Database ID 5, Page (1:4034991), slot 0 for LOB data type node does not exist. This is usually caused by transactions that can read uncommitted data on a data page. Run DBCC CHECKTABLE.

                2014-04-29 15:04:06.45 spid118     Error: 7105, Severity: 22, State: 12.

                2014-04-29 15:04:06.45 spid118     The Database ID 5, Page (1:4034991), slot 0 for LOB data type node does not exist. This is usually caused by transactions that can read uncommitted data on a data page. Run DBCC CHECKTABLE.

                2014-04-29 15:04:09.01 spid75      Error: 7105, Severity: 22, State: 12.

                 

                After looking problem solution on McAfee pages I found one information about DLP having problem with moving events to Debug folder. Checked it and yes, they're moving like... hundred of thousands.

                Can you check it's the same issue?