Error: Processing Dimension 'EP Agent Behavior Event Description' failed.

Products

• IT Analytics

Issue/Introduction

The following error is returned during SEP Agent Behavior Event cube processing:

Errors in the back-end database access module. The read operation was cancelled due to an earlier error. Errors in the OLAP storage engine: An error occurred while the 'Agent Behavior Event - Description' attribute of the 'EP Agent Behavior Event Description' dimension from the 'ITAnalytics' database was being processed.

These additional messages are returned under Errors and Warnings from Response in the Process Progress window in SQL Server Management Studio (SSMS):

Errors in the OLAP storage engine: An error occurred while the 'Agent Behavior Event - Description' attribute of the 'EP Agent Behavior Event Description' dimension from the 'ITAnalytics' database was being processed.

Errors in the back-end database access module. The read operation was cancelled due to an earlier error.

Errors in the OLAP storage engine: An error occurred while the 'Agent Behavior Event - Description' attribute of the 'EP Agent Behavior Event Description' dimension from the 'ITAnalytics' database was being processed.

Server: The current operation was cancelled because another operation in the transaction failed.

Errors in the back-end database access module. The size specified for a binding was too small, resulting in one or more column values being truncated.

Environment

IT Analytics for SEP (all versions)

Cause

This error is caused by the string length of a description value for an endpoint in the Symantec Endpoint Protection (SEP) data source exceeding 256 characters. The dimension expects a string value of 256 characters or less.

To verify this is the cause of the error, the following query will return any records from the SEP data source with a description value that exceeds the 256 character limit (Note: the SEP linked server hostname specified in the OPENQUERY statement will be unique to your environment):

SELECT DISTINCT [DESCRIPTION]
FROM OPENQUERY
  (
   [<SEPM_hostname>],
    '
   SELECT *
   FROM [dbo].[V_AGENT_BEHAVIOR_LOG] (NOLOCK)
   '
  )
WHERE LEN([DESCRIPTION]) > 256;

Resolution

This issue is resolved by altering the IT Analytics database view vITAnalytics_SEP_AgentBehaviorEventDescriptionDim to truncate description values that exceed 256 characters in length.

To make this change, follow this procedure:

1. Open SQL Server Management Studio (SSMS)
2. In the Connect to Server window, select the Server type 'Database Engine' and provide the name or IP address of your IT Analytics database host (and instance name, if not the default instance) as the Server name
3. Connect using the Authentication method enabled during the installation of IT Analytics
4. Expand the Databases folder under the host name in the Object Explorer pane
5. Locate and expand the IT Analytics database (the default name is 'ITAnalytics')
6. Expand the Views folder
7. Locate the view dbo.vITAnalytics_SEP_AgentBehaviorEventDescriptionDim
8. Right-click this view, select Script View as : ALTER To : New Query Editor Window
9. In the query editor window, edit line 16 by replacing this:

   DISTINCT [DESCRIPTION]

   with this:

   DISTINCT CAST([DESCRIPTION] AS NVARCHAR(256)) AS [DESCRIPTION]

10. Execute the ALTER statement by pressing the function key F5, clicking the Execute button in the SSMS toolbar, or selecting Execute from the Query menu

Additional Information

Unmodified, the view vITAnalytics_SEP_AgentBehaviorEventDescriptionDim is defined as follows (Note: the SEP linked server hostname specified in the OPENQUERY statement will be unique to your environment):

SELECT [DESCRIPTION]
FROM (SELECT [DESCRIPTION] COLLATE DATABASE_DEFAULT AS [DESCRIPTION]
   FROM OPENQUERY([<SEPM_hostname>],
'SELECT 
   DISTINCT [DESCRIPTION]
   FROM         
   [dbo].[V_AGENT_BEHAVIOR_LOG] (NOLOCK) ')
  ) as AgentBehaviorEventDescriptionDim
GO

The following is the view definition with an additional CAST function added to the first SELECT statement to truncate the description field as it is queried from the SEP data source:

SELECT [DESCRIPTION]
FROM (SELECT [DESCRIPTION] COLLATE DATABASE_DEFAULT AS [DESCRIPTION]
   FROM OPENQUERY([<SEPM_hostname>],
'SELECT 
   DISTINCT CAST([DESCRIPTION] AS NVARCHAR(256)) AS [DESCRIPTION]
   FROM         
   [dbo].[V_AGENT_BEHAVIOR_LOG] (NOLOCK) ')
  ) as AgentBehaviorEventDescriptionDim