Malformed events after applying FIX:RO90350

Products

• CA Security Command Center
• CA Data Protection (DataMinder)
• CA User Activity Reporting

Issue/Introduction

After applying FIX:SO01032 (incorporating Integration_14.5_HF0239 and Integration_x64_14.5_HF0240) - see Data Protection integration using an EMC SourceOne Office 365 job, for more information - some events appear to be malformed.  This may include the following attributes.

• Have no Sender
• Have no Subject
• Have processed only part of the mail for example, some attachments may be missing.

Environment

CA Data Protection 14.5.

Cause

This was a caused by a programmatic issue during the mail identification stage.  While identifying the journal mail the code checks for the substring "X-MS-Journal-Report" in the mail header. In some cases for non-journal mails the substring was incorrectly identified because previously processed journal mail buffer stream was followed by an improper null terminated character.

Resolution

FIX:SO04571 (incorporating Integration_14.5_HF0241 and Integration_x64_14.5_HF0242) has been released to address this issue.  The fix is available to download from the CA Support Portal (http://support.ca.com).
 

Additional Information

Orchestria APM, Orchestria EPM, Orchestria, CA DLP and CA DataMinder are all previous brands for the product known as CA Data Protection.