Incidents are not being processed (MESSAGEORIGINATOR_PK)

Products

• Data Loss Prevention Network Discover
• Data Loss Prevention
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Plus Suite

Issue/Introduction

Incidents are not being processed by the incident persister and are backing up in the Incidents directory on the Enforce Server.

Error Message:
* SQLException during execution of sql-statement:
* sql statement was 'INSERT INTO MessageOriginator (messageOriginatorID,IPAddress,networkPort,networkSenderIdentifier,domainUserName,endpointMachineName,lastActivityTime) VALUES (?,?,?,?,?,?,?) '
* Exception message is [ORA-00001: unique constraint (PROTECT.MESSAGEORIGINATOR_PK) violated

Cause

Customer had recently migrated their database, and migrated the metadata first, not taking into account the sequences. This resulted in the sequences being "off" and Enforce was now reusing numbers for incidents that had already been used, resulting in this error message.

 

Resolution

Increase sequence higher than the index.

Additional Information

DLP should increment this automatically, this error can only occur if the index has somehow increased beyond the sequence.  This could be caused by an incomplete backup/restore, or manual manipulation of the database.