Symantec Data Loss Prevention (DLP) Enforce server is filling up with .bad files located in \Vontu\Protect\Incidents or \SymantecDLP\Protect\Incidents.

Additionally, a 404 browser redirect error may be present when navigating in the Enforce console.

IncidentPersister0.log

Caused by: com.vontu.incidenthandler.TransientPersistingException: com.vontu.model.DataAccessRuntimeException: org.apache.ojb.odmg.TransactionAbortedExceptionOJB: Can't commit objects: * SQLException during execution of sql-statement: * sql statement was 'INSERT INTO MessageLob (messageLobID,messageID,networkOriginalMessage,keyAlias) VALUES (?,?,?,?) ' * Exception message is [ORA-01691: unable to extend lob segment PROTECT.SYS_LOB00000216545649C00003$$ by 2768 in tablespace LOB_TABLESPACE ] * Vendor error code [1691] * SQL state code [72000]

VontuIncidentPersister.log

Unable to extend Tablespace USERS Unable to extend Tablespace LOB_TABLESPACE

This is due to the LOB_TABLESPACE in the DLP Oracle database running out of space which then prevents the Enforce server from processing incidents.

Confirm the LOB_TABLESPACE is full:

1. Log into the Enforce console.
2. Go to  System > Database > Tablespaces Summary
3. Find the entry for LOB_TABLESPACE in the Tablespaces Allocation table.

NOTE: If you cannot access the console, you may run the following query in sqlplus as sysdba to see tablespace usage instead: 

set pages 100
set lines 100
SELECT d.status "Status",
  d.tablespace_name "Name",
  TO_CHAR(NVL(a.bytes / 1024 / 1024, 0),'99999990D900') "Size (M)",
  TO_CHAR(NVL(NVL(f.bytes, 0), 0)/1024/1024 ,'99999990D900') "Free (MB)",
  TO_CHAR(NVL((NVL(f.bytes, 0)) / a.bytes * 100, 0), '990D00') "Free %"
 FROM sys.dba_tablespaces d,
  (select tablespace_name, sum(bytes) bytes from dba_data_files group by tablespace_name) a,
  (select tablespace_name, sum(bytes) bytes from dba_free_space group by tablespace_name) f
  WHERE d.tablespace_name = a.tablespace_name(+)
  AND d.tablespace_name = f.tablespace_name(+)
  AND NOT (d.extent_management like 'LOCAL'  AND d.contents like 'TEMPORARY')
 order by "Free %";
-------------------------------------------------------------------------------

You should see an output similar to the following with a lower FREE % nearing 0%:

To resolve the issue:

1. Increase the size of the LOB_TABLESPACE (see Guidance for how to extend tablespace in Oracle )
2. You have the following two options to clear up the .bad files
   1. Rename the .bad files  to .idc which should allow the incidents to be processed (Recommended)
   2. Delete the .bad files (These incidents will be permanently lost)

References:

What is a .bad file?

Where is the Oracle alert_protect.log?

What is the LOB_TABLESPACE used for?

How do I extend tablespace in Oracle?