What is a .bad file?


Article ID: 159855


Updated On:


Data Loss Prevention Enforce


There are a lot of .bad files in the \incidents folder. What are they? What should be done?


Incidents from the various detection servers arrive on the Enforce server as a file in the \incidents folder. The name is a string of numbers and the file type is .idc. The IncidentPersister takes incident files from the incidents folder and puts them into the database. When an incident is successfully processed into the database the file is deleted.

If there is a problem processing the incident file and it can not be completed, the file type is changed to .bad. This allows the IncidentPersister to skip that file and process the remaining incident files.

There are several problems that can prevent the IncidentPersister from successfully putting an incident into the database.

- The IP has a problem communicating to the DB during the operation

- The DB can not add the incident information to the tables

- The LOB_TABLESPACE tablespace is full and needs additional datafiles added to it

- The incident file is unusable or unreadable

The problems are usually logged in the IncidentPersister log. Starting in V8, a System Event is also generated.  Contact Technical Support if you need assistance correcting any issues.

Once the problem is corrected, the incident can be resubmitted by changing the .bad to .idc