search cancel

SQL Error 7886: A read operation on a large object failed while sending data to the client

book

Article ID: 162500

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

This error is logged on the Microsoft SQL Server for the Symantec Endpoint Protection Manager (SEPM) database. The SEPM does not experience any particular symptoms and appears to be functioning correctly.

2015-09-30 06:16:53.08 spid93 Error: 7886, Severity: 20, State: 1.
2015-09-30 06:16:53.08 spid93 A read operation on a large object failed while sending data to the client. A common cause for this is if the application is running in READ UNCOMMITTED isolation level. This connection will be terminated. 

Cause

The issue is from a getMetadata SQL query which is executed during Liveupdate.

The query that can cause this is:

SELECT NAME, CHECKSUM, DELETED, ID, REF_ID, OWNER, TIME_STAMP, TYPE, USN,
DOMAIN_ID, DESCRIPTION, CONTENT FROM BASIC_METADATA WITH (NOLOCK) WHERE ID =
CONVERT(CHAR(32), @P0 ) AND DELETED > 0

The query is ran with the "NOLOCK" hint, this hint is used to improve performance by not locking the database tables. When one or more objects being retrieved by this query are modified before the statement completes, the query will be aborted and the SQL error will be generated.

Resolution

This error can occur due to a large variety of environmental factors, some of which cannot be prevented by the current design of the Endpoint Protection Manager.  This error will not impact SEPM functionality as the read operation will simply be run again.  In order to reduce the number of instances of this error, you can attempt the following workarounds.  

  1. Upgrade the SEPM to 14.0 or later.  Changes have been made in this release that can significantly reduce the frequency of these errors.  For information see how to download the latest version of Symantec Endpoint Protection.
  2. Reduce the amount of content stored by the SEPM.  The read error occurs when reading LiveUpdate XML data.  Reducing the amount of content will allow for faster reads.  You can reduce the amount of content by lowering the number of revisions stored on the SEPM.  If you have 12.1 and 14.0 content on the same manager, consider moving 14.0 clients to a separate SEPM site that only hosts 14.0 content.  
  3. Do not set LiveUpdate to run continously, this will increase the frequency of this error.  Change LiveUpdate frequency to the default value of every 4 hours.