Warning code 4053 'Agent Time Update Failed' found in Enforce Server events

Products

• Data Loss Prevention
• Data Loss Prevention Enforce
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

You observe 'Agent Time Update Failed' warnings in the Enforce Server events similar to what is shown below:

At the same time, in the MonitorController(n).logs, you will see the following warnings:

com.symantec.dlp.services.agenttimeupdate.AgentTimeUpdateListener executeStoredProcedure
WARNING: Processing of agent: WIN10B failed with error code: 100 ORA-01403: no data found
com.vontu.logging.LocalLogWriter write
WARNING: Agent Time Update Failed. Agent Time Update Failed

Environment

DLP 15.x

Cause

This issue will occur when an event is received by Enforce (DetectionServerControllerService/MonitorController) from an agent for which there is no corresponding agent record in the Agent table within the Enforce database.

This should never occur in normal operations (with agents > v12.5) and could indicate that an agent was manually removed from the Agent table.

• This could happen if an agent's last version was 12.5 or newer (Family = 0 in the Agent table), because the AgentDeletor task that runs at 1am actually deletes agents that are 12.5 or older.
• Agents newer than 12.5 are set to IsDeleted=1 and never deleted by the DLP software.

Resolution

Remove and re-install the DLP agent to get the agent record recreated in the Agent table in the Enforce database, which will prevent this warning for future incidents.

If the client should not be monitored, remove the DLP agent.

Additional Information

See also: DLP Agent installation general overview