Error: "3901, System Events have been suppressed" in DLP Endpoint Prevent

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

The Data Loss Prevention (DLP) Endpoint Prevent server has the following error:

3901
System events have been suppressed.
System event throttle limit exceeded. nnn events have been suppressed. Internal error code = communications_error.

To view this error:

1. Log into the Enforce console and click on the “System” tab.
   The System > Servers and Detectors > Overview page opens.
2. Select your Endpoint Detection Server.
   The 3901 error is located in either the “Recent Error and Warning Events” or “All Recent” events box.
   
   Note: Click Show All to view a longer list of errors and events, when available.
   
   
3. Next check your Aggregator#.log on your Endpoint Server for the following error:
   • java.lang.IllegalArgumentException: Programming error. Received an acknowledgement for successful replication of
   • For the location of the Aggregator log refer to the Broadcom support Debug log files page.

Resolution

• The 3901 error is normally seen when the system is flooded with numerous agent events.
• To avoid log flooding, the server dampens these events resulting in the 3901 error.