1802 Error Code Enforce: Corrupt incident received

Products

• Data Loss Prevention Enforce

Issue/Introduction

Incidents are getting corrupted, and you are getting event code 1802.

You should see the following events occur in the IncidentPersister logs that correlate the event. 

Level: SEVERE
Thread: 113
Source: com.vontu.incidenthandler.message.persist.convert.v14.MessageComponentProcessor.createComponentsAndIncidents
Message: Violations beyond 500 have been discarded for incident ID: 7965542 per max.violation.per.message property value

 

Level: SEVERE
Thread: 113
Source: com.vontu.incidenthandler.message.persist.convert.v14.MessageComponentProcessor.createComponentsAndIncidents
Message:  Violations beyond 1000 have been discarded for Message ID: 7790040 per max.component.per.message

 

Level: SEVERE
Thread: 113
Source: com.vontu.incidenthandler.message.persist.IncidentPersistingThread.cleanupIncidentFile
Message: Over size incident retention is false, incident file discarded: l1516495310144.idc_1516496014727.idc

 

Environment

Data Loss Prevention Enforce  

Cause

As the logs will specify, parameters within the IncidentPersister.properties file are getting violated in regards to the incident, and thus the processing is destroyed and the incident is subsequently corrupted.

Resolution

Within the IncidentPersister.properties file on the Enforce server, enter in the custom parameter of large.incident.file.retention = true and then large incidents will be retained on the file system for later processing. This way you will not need to mess with the other two parameters and risk running into Out-of-memory errors.