Error Code 1807 : Summary Response rule processing execution failed Detail Response rule command runtime execution failed

Products

• Data Loss Prevention

Issue/Introduction

Reason for the Error executing command: syslog.

Incident Persister logs:

Sep 13, 2012 10:06:18 AM (SEVERE) Thread: 20 [com.vontu.command.CommandRuntime.execute] Error executing command: syslog
com.vontu.command.CommandException: Unable to write to syslog: host=xxxx, port=514
 at com.vontu.incidenthandler.command.enforce.SyslogLogger.execute(SyslogLogger.java:128)
 at com.vontu.command.CommandRuntime.execute(CommandRuntime.java:776)
 at com.vontu.command.CommandRuntime.executeInstructions(CommandRuntime.java:759)
 at com.vontu.command.CommandRuntime.executeCommands(CommandRuntime.java:676)
 at com.vontu.command.CommandRuntime.access$000(CommandRuntime.java:61)
 at com.vontu.command.CommandRuntime$CommandExecutor.run(CommandRuntime.java:1136)
 at edu.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:728)
 at java.lang.Thread.run(Thread.java:662)

Caused by: com.vontu.util.syslog.SyslogException: Syslog message to large: size: 1540 MAX_MESSAGE_SIZE: 1460
 at com.vontu.util.syslog.SyslogMessage.makeBytes(SyslogMessage.java:141)
 at com.vontu.util.syslog.SyslogMessage.<init>(SyslogMessage.java:24)
 at com.vontu.util.syslog.Syslog.syslog(Syslog.java:45)
 at com.vontu.incidenthandler.command.enforce.SyslogLogger.execute(SyslogLogger.java:107)

Resolution

The maximum message limit for the syslog server notifications is 1024 characters. If the custom attributes are being used then the probability for the message to violate that limit is on a higher side.