Incidents will not persist to Enforce Server

book

Article ID: 159562

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent Data Loss Prevention Network Monitor Data Loss Prevention Network Prevent for Email Data Loss Prevention Network Prevent for Web Data Loss Prevention Network Protect Data Loss Prevention Endpoint Discover

Issue/Introduction

Relevant Versions:  ALL Detection Servers on Windows

After a while,  the Detection server has difficulties sending incidents to the Enforce server.  They either get stuck or persist very slowly.

Possible error messages:

In the MonitorController#.log on the Enforce Server:


INFO: Receiving Task(33216): Timed-out reading packet from queue

In the IncidentWriter#.log on the Detection Server

com.vontu.communication.dataflow.ShippingTask processErrorResponse WARNING: Shipping Task(33216): The shipment was aborted because the receiving task timeout out!

com.vontu.logging.LocalLogWriter write SEVERE: Error sending incident. Unexpected error occurred while sending an incident.
The shipment was aborted because the receiving task timeout out!

Resolution

This problem can be caused by not having SP2 for W2K3 applied to the Detection server.  Make sure that SP2 is applied.