Unexpected Agent Data Batch Persist alerts (code 4050) after an upgrade to 16.0 RU1

Products

• Data Loss Prevention Enforce
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

It may be observed that after an upgrade of the DLP environment from any earlier build to 16.0 RU1, an increased number of Agent Data Batch Persist alerts are seen reported on Enforce. 

Enforce logs (specifically MonitorController log) should be checked for a specific cause of any occurrence of this alert, but one of the possible reasons is Enforce disconnecting frequently from Oracle Server. 

Example log entry that would indicate that specific failure due to disconnection from DB

Agent data batch persist error. Unexpected error occured while agent data being persisted : CallableStatementCallback; Closed Connection; nested exception is java.sql.SQLRecoverableException: Closed Connection. Please look at the detection server controller logs for more information.

This may be especially seen if there is a firewall between Enforce and Oracle which is set to terminate idle connections. For example, the firewall may be configured to terminate all connections idle for more than 60 minutes. 

Environment

Release: 16.0.1

Cause

The cause of this is described in KB article Connectivity to the Cloud Service is intermittent and requires a MonitorController service restart

As the KB says, up until 16.0 MP1, there's a limitation on the side of Enforce which allows connections to go inactive without actually closing them. Then these connections could be closed by the firewall. As a result, Enforce would lose connectivity to the Service until DLP services were restarted.

This is fixed in DLP 16.0 MP2 with an introduction of a configuration parameter CONNPOOL_INACTIVE_TIMEOUT that allows Enforce to close idle connections itself after a configured period of inactivity.

That new property is also described in the Online Help page New Connection Pool Property

Resolution

You can refer to the above linked KB article and Online Help page for details on how to set the CONNPOOL_INACTIVE_TIMEOUT. By default it's set to 0 (no timeout). Or if the property is absent from the configuration file ConnectionPool.properties, Enforce will assume it to be 0. 

After following the documented procedure and setting CONNPOOL_INACTIVE_TIMEOUT to a specific non-zero value, the alerts 4050 caused by the disconnections between Enforce and Oracle should no longer be happening. 

Additional Information

This property was introduced in 16.0 MP2 version

Check below the Related Information: - 

Connectivity to the Cloud Service is intermittent and requires a MonitorController service restart