DLP - Bulk attributes lookup against more than 1000 incidents lead to Oracle ORA-01795 error

book

Article ID: 192864

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

Data Loss Prevention (DLP)
Enforce

On the incident report page, add a filter with more than 1,000 values (for example: 'Incident ID' 'Is Any Of' <list of 1000+ IDs>) and click 'Apply' to run the report. 
The UI immediately displays a RSOD (red screen of death). 

A similar problem exists for incident attributes lookup: 
'Select All' for a report containing more than 1000 incidents and choose 'Incident Actions' menu, 'Lookup Attributes' option.

The localhost log has the following entries:

Level: WARNING
Source: com.vontu.manager.struts.transactions.AllowsTransactionalProxy
Message: Exception thrown by class com.vontu.manager.incident.operation.BulkLookupCustomAttributes.execute

Level: SEVERE
Source: com.vontu.manager
Message: [/BulkLookupCustomAttributes] Unexpected error occurred while processing action

Level: SEVERE
Source: com.vontu.manager
Message: [/BulkLookupCustomAttributes] 
Cause:
java.lang.RuntimeException: com.vontu.util.ProtectException: Protect Error 1: Data access error.
com.vontu.util.ProtectException: Protect Error 1: Data access error.
java.sql.SQLSyntaxErrorException: ORA-01795: maximum number of expressions in a list is 1000

Cause

This is cause by an Oracle limitation.

https://support.oracle.com/knowledge/Oracle%20Database%20Products/406321_1.html

Environment

Release : 15.1

 

Resolution

This was fixed the following releases:

15.0.0118.01003
15.1 MP1
15.5.0.15008

Attachments