Incident Persister shows ORA-00001 errors for MESSAGEEXT

Products

Data Loss Prevention Data Loss Prevention Enforce Data Loss Prevention Oracle Standard Edition 2

Issue/Introduction

The Incident Persister logs indicate ORA-00001 errors for data that was not inserted into the DLP database.

VontuIncidentPersister.log shows:

INFO | jvm 1 | 2017/01/10 08:04:48 | [org.apache.ojb.broker.accesslayer.JdbcAccessImpl] ERROR: INFO | jvm 1 | 2017/01/10 08:04:48 | * SQLException during execution of sql-statement: INFO | jvm 1 | 2017/01/10 08:04:48 | * sql statement was 'INSERT INTO MessageExt (messageExtID,messageID,eventContentID,messageProcessingState,isDetectedOnEndpoint,contentSequenceId,isBlobExternalized) VALUES (?,?,?,?,?,?,?) ' INFO | jvm 1 | 2017/01/10 08:04:48 | * Exception message is [ORA-00001: unique constraint (PROTECT.MESSAGEEXT_U1) violated INFO | jvm 1 | 2017/01/10 08:04:48 | ] INFO | jvm 1 | 2017/01/10 08:04:48 | * Vendor error code [1] INFO | jvm 1 | 2017/01/10 08:04:48 | * SQL state code [23000=INTEGRITY CONSTRAINT VIOLATION] INFO | jvm 1 | 2017/01/10 08:04:48 | * Target class is 'com.vontu.model.data.ojb.MessageExtImpl' INFO | jvm 1 | 2017/01/10 08:04:48 | * PK of the target object is [messageExtIDRef=3750497] INFO | jvm 1 | 2017/01/10 08:04:48 | * Source object: messageExtID: 3750497, messageID: 3750517, eventContentID: 53F27317-084D-40F3-9CE0-375E40D4045B, messageProcessingState: 0, isDetectedOnEndpoint: 1, contentSequenceId: null, isBlobExternalized: 0, INFO | jvm 1 | 2017/01/10 08:04:48 | * The root stack trace is --> INFO | jvm 1 | 2017/01/10 08:04:48 | * java.sql.SQLIntegrityConstraintViolationException: ORA-00001: unique constraint (PROTECT.MESSAGEEXT_U1) violated INFO | jvm 1 | 2017/01/10 08:04:48 | INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:450) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:399) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.T4C8Oall.processError(T4C8Oall.java:1059) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:522) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:257) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:587) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:225) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:53) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.T4CPreparedStatement.executeForRows(T4CPreparedStatement.java:943) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1150) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:4798) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.OraclePreparedStatement.executeUpdate(OraclePreparedStatement.java:4875) INFO | jvm 1 | 2017/01/10 08:04:48 | at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeUpdate(OraclePreparedStatementWrapper.java:1361) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.commons.dbcp.DelegatingPreparedStatement.executeUpdate(DelegatingPreparedStatement.java:101) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.broker.accesslayer.JdbcAccessImpl.executeInsert(JdbcAccessImpl.java:211) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.broker.core.PersistenceBrokerImpl.storeToDb(PersistenceBrokerImpl.java:1891) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.broker.core.PersistenceBrokerImpl.store(PersistenceBrokerImpl.java:879) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.broker.core.DelegatingPersistenceBroker.store(DelegatingPersistenceBroker.java:158) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.broker.core.DelegatingPersistenceBroker.store(DelegatingPersistenceBroker.java:158) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.odmg.ObjectEnvelope.doInsert(ObjectEnvelope.java:644) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.odmg.states.StateNewDirty.commit(StateNewDirty.java:106) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.odmg.ObjectEnvelopeTable.writeAllEnvelopes(ObjectEnvelopeTable.java:241) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.odmg.ObjectEnvelopeTable.writeObjects(ObjectEnvelopeTable.java:178) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.odmg.TransactionImpl.doWriteObjects(TransactionImpl.java:403) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.odmg.TransactionImpl.prepareCommit(TransactionImpl.java:762) INFO | jvm 1 | 2017/01/10 08:04:48 | at org.apache.ojb.odmg.TransactionImpl.commit(TransactionImpl.java:698) INFO | jvm 1 | 2017/01/10 08:04:48 | at com.vontu.model.ojb.OJBSystem.commitTransaction(OJBSystem.java:348) INFO | jvm 1 | 2017/01/10 08:04:48 | at com.vontu.model.ModelProxy.commitTransaction(ModelProxy.java:55) INFO | jvm 1 | 2017/01/10 08:04:48 | at com.vontu.model.notification.NotificationModel.commitTransaction(NotificationModel.java:166) INFO | jvm 1 | 2017/01/10 08:04:48 | at com.vontu.model.ModelProxy.commitTransaction(ModelProxy.java:55) INFO | jvm 1 | 2017/01/10 08:04:48 | at com.vontu.incidenthandler.message.persist.SerializableMessageDatabasePersistor.persistMessage(SerializableMessageDatabasePersistor.java:229) INFO | jvm 1 | 2017/01/10 08:04:48 | at com.vontu.incidenthandler.message.persist.SerializableMessageDatabasePersistor.persistMessage(SerializableMessageDatabasePersistor.java:103) INFO | jvm 1 | 2017/01/10 08:04:48 | at com.vontu.incidenthandler.message.persist.IncidentPersistingThread.run(IncidentPersistingThread.java:140) INFO | jvm 1 | 2017/01/10 08:04:48 | at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) INFO | jvm 1 | 2017/01/10 08:04:48 | at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

Environment

Data Loss Prevention Enforce versions 15.x and 16.x

Cause

The error occurs when a duplicate incident is detected, this is generally not expected behavior.
This can occur under the following conditions:

A transient network error occurred and the same incident was sent to the Enforce server twice.
A 2nd enforce server's services have started such as a backup or failover Enforce server causing a 2nd instance of incident Persister to be attempting to persist incidents to the database.

Resolution

If the issue is infrequent: Ensure proper connectivity between detection servers and enforce.
If the issue is frequent: Ensure that their services from a 2nd Enforce are not communicating with the same database, such as a backup or high availability server.