search cancel

Error: "3901, System Events have been suppressed" in DLP Endpoint Prevent

book

Article ID: 174070

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent

Issue/Introduction

The Data Loss Prevention (DLP) Endpoint Prevent server has the following error:

3901
System events have been suppressed.
System event throttle limit exceeded. nnn events have been suppressed. Internal error code = communications_error.

To view this error:

  1. Log into the Enforce console and click on the “System” tab.
    The System > Servers and Detectors > Overview page opens.
  2. Select your Endpoint Detection Server.
    The 3901 error is located in either the “Recent Error and Warning Events” or “All Recent” events box.

    Note: Click Show All to view a longer list of errors and events, when available.

  3. Next check your Aggregator#.log on your Endpoint Server for the following error:
    • java.lang.IllegalArgumentException: Programming error. Received an acknowledgement for successful replication of
    • For the location of the Aggregator log refer to the Debug log files Symantec help page.

Cause

  • The 3901 error is normally seen when the system is flooded with numerous agent events.
  • To avoid log flooding, the server dampens these events resulting in the 3901 error.
  • The 3901 error is normally associated with a known issue related to DLP 15.0 MP1 where agent events are excessively duplicated.

Resolution