Yellow banner error: "The message body cannot be accessed for this incident" when opening an incident in DLP

Products

• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

When accessing a new incident two yellow banner errors are displayed.
And no data appears in the body of the incident.

This happened after upgrading the Symantec Data Loss Prevention (DLP) Oracle database from 12c to 19c.

-------------------------------------------------------------------------------------------

There was an error highlighting the violating text for this incident.
The message body cannot be accessed for this incident.

-------------------------------------------------------------------------------------------

The Enforce localhost log has these entries:

Level: SEVERE
Source: com.vontu.manager.report.snapshot.IncidentInfoTable$IncidentInfoIterator
Message: Error retrieving message body for incident ID: 210330 component ID: 0
Cause:
com.vontu.security.crypto.CryptoException: Cipher output error.com.vontu.security.crypto.CryptoException: Cipher output error.
Caused by: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

Level: WARNING
Source: com.vontu.manager.report.snapshot.IncidentDetailPage
Message: (MANAGER.201) Error accessing message body for incident 210,330, incident detail will be rendered without it
Cause:
com.vontu.security.crypto.CryptoException: Cipher output error.com.vontu.security.crypto.CryptoException: Cipher output error.

Level: SEVERE
Source: com.vontu.query.BackgroundQueryExecutor
Message: Exception in BackgroundQueryExecutor background thread while  processing query com.vontu.manager.report.snapshot.matches.ViolatingComponentLoaderQuery@3f21202f
Cause:
com.vontu.query.QueryException: com.symantec.dlp.incidentdomainservices.matching.MatchHighlightingRuntimeException: Unable to load and convert cracked component: 360811
Caused by: com.vontu.util.unicode.CharacterConversionException: java.io.IOException: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

Level: WARNING
Source: com.vontu.manager.report.snapshot.IncidentDetailPage
Message: (MANAGER.200) Error generating match highlighting for incident 210,327, incident detail will be rendered without them
Cause:
com.vontu.manager.report.snapshot.matches.MatchHighlightingException: Error marking violating content for incident
Caused by: com.vontu.util.concurrent.BlockingQueueRuntimeException: com.vontu.util.concurrent.BlockingQueueRuntimeException: com.symantec.dlp.incidentdomainservices.matching.MatchHighlightingRuntimeException: Unable to load and convert cracked component: 360811
Caused by: com.vontu.util.unicode.CharacterConversionException: java.io.IOException: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption

 

Note:

There are no out-of-memory errors in the Enforce logs.

Environment

Release: DLP 15.7 and Oracle 19c - This may manifest itself with any version of DLP.

 

Resolution

Restart the Enforce server and all Detection servers.
This re-syncs the ciphers between the servers.