Enforce Incident Queue backup ORA-22275 ORA-1652 ORA-01110 ORA-00376

Products

• Data Loss Prevention Enforce

Issue/Introduction

In general, a backlog is indicative of either slow processing due to a component or size of an incident or lack of resources.

Resolution

Relevant versions: ALL

• Symptom:  Enforce Incident queue backlog increases after disk has filled up and additional disk added.
• alert_protect.log shows:  ORA-1652 : unable to extend temp segment by 4 in tablespace TEMP0
• Incident.persister.log shows:  Caused by: java.sql.SQLException: ORA-22275: invalid LOB locator specified
  
  java.io.IOException: ORA-00376: file 203 cannot be read at this time
  
  INFO | jvm 1 | 2007/07/09 14:40:16 | ORA-01110: data file 203: '/u01/oracle/protect/datafiles/temp0.dbf'
  
  

Resolution:

1. Check the status of .dbfs using sqlplus as sysdba:
1. SELECT file#,name,status,enabled from v$tempfile;
2. If TEMP0 shows offline, you will need to bring it back online. To bring it online:
1. ALTER database datafile <full_path_datafile_name> online;
2. Example:  ALTER database datafile /u01/oracle/protect/datafiles/temp0.dbf' online;
3. Then stop Vontu services on Enforce Manager.
4. Stop and restart DB and Listener.
5. Restart Vontu services on Enforce Manager.
6. Verify that Incident queue decreases