DLP System Event Codes and resolutions
search cancel

DLP System Event Codes and resolutions

book

Article ID: 396182

calendar_today

Updated On:

Products

Data Loss Prevention Data Loss Prevention API Detection Data Loss Prevention Cloud Detection Service Data Loss Prevention Cloud Detection Service for ICAP Data Loss Prevention Cloud Detection Service for REST Data Loss Prevention Cloud Package Data Loss Prevention Cloud Service for Email Data Loss Prevention Cloud Storage Data Loss Prevention Core Package Data Loss Prevention Data Access Governance Data Loss Prevention Discover Suite Data Loss Prevention Endpoint Discover Data Loss Prevention Endpoint Prevent Data Loss Prevention Enforce Data Loss Prevention Enterprise Suite Data Loss Prevention Form Recognition Data Loss Prevention Network Discover Data Loss Prevention Network Monitor Data Loss Prevention Network Monitor and Prevent for Email Data Loss Prevention Network Monitor and Prevent for Email and Web Data Loss Prevention Network Monitor and Prevent for Web Data Loss Prevention Network Prevent for Email Data Loss Prevention Network Protect Data Loss Prevention Oracle Standard Edition 2 Data Loss Prevention Plus Suite Data Loss Prevention Sensitive Image Recognition

Issue/Introduction

You've seen the 25.1 System Event Codes and Messages list in the TechDocs, but want to know if there are KB articles about specific codes in DLP.

 

Environment

25.x and 16.x Supported releases

Resolution

The below table provides a known list of KB articles for issues related to specific Event Codes returned in the DLP Enforce Console management server.

Code
Summary
Description
KB(s) written for this specific error
1008{0} is down{0} process went down before it had fully started.RequestProcessor Status fails to start with event code 1008
1213{0} messages timed out in Detection recently{0} messages timed out in Detection in the last {1} minutes. Enable Detection execution trace logs for details.Event code 1213 "Messages timed out in detection"
1214Detected regular expression rules with invalid patternsPolicy set contains regular expression rule(s) with invalid patterns. See FileReader%.log for detailsDLP 15.8 Event Code 1214 appears
1216The Execution Matrix has reached the memory limit of {0} MBsor the Endpoint Server didn't have enough memory to handle it. The Execution Matrix has reached the set memory limit or the Endpoint Server didn't have enough memory to handle and ship it. Legacy Agents will not receive new policies until they get upgraded or the policy set is simplified.About policy distribution to agents prior to 16.0+ agent deployment
1302File Reader failed to startError starting File Reader. {0} No incidents will be detected.Event Code 1302 - Error starting File Reader. Failed to create server socket on address:port - 0.0.0.0:1344. No incidents will be detected.
1409Icap secure keystore certificate about to expire soon

This shows that a certificate in the keystore is about to expire

Console showing "Error code 1409: Icap secure keystore certificate about to expire soon"

1801Incident persister failed to process incident

 Incident Persister failed to process incident

Dealing with corrupt incidents.

1802Corrupt incident received

A corrupted incident was received, and renamed to {0}

Error 1802: Corrupted incident received" under Recent Events
1803Policy misconfiguredPolicy "{0}" has no associated severity.

Event Code 1803 Policy has no associated severity

Dealing with corrupt incidents.

1806Response rule processing failed to startResponse rule processing failed to start: {0}.Enforce error code 1806 - Response rule processing failed to start: initialization failed.
1807Response rule command runtime execution failedMore detail as to the cause should be provided in the error

Enforce Server displays error "1807 - Response rule command runtime execution failed from error: Error executing command: notify"

Response rule processing failed

1818Incident is oversizedhas been persisted with a limited number of components and/or violations Incident is oversized has been partially persisted with messageID {0} Incident File Name {1}Enforce Shows System Event Code 1818 - "Incident is oversized"
1821Failure to process an incident received from the cloud gateway.Unexpected error occurred while processing incident received from cloud gateway.Code 1821 Failure to process an incident received from the cloud gateway Unexpected Error Processing Incident
2115Custom attribute lookup failedFailed to instantiate lookup plug-in {0}. It was unloaded. Error message: {1}Error: "2115 - Custom attribute lookup failed" in DLP Detector Detail
2301Tablespace is almost fullOracle tablespace {0} is over {1}% full.Oracle tablespace (LOB_TABLESPACE, USERS, etc.) for DLP is full, almost full, or critically full
2317Failed to send incident email notificationEmail notification was not sent for Incident "{0}" and Policy "{1}". {2}DLP Event Code 2317 - Failed to send incident email notification with no recipients defined
2318Incident deletion flagging process started.Incident deletion flagging process started.Troubleshooting automatic incident deletion flagging
2319Incident deletion flagging process ended.Incident deletion flagging process ended.
2405Unable to run scheduled reportThe scheduled report {0} owned by {1} encountered an error: {2}.Scheduled report fails to send
2500Unexpected Error Processing MessageMessage chain #{0} encountered an unexpected error processing a message. See the log file for details.Network Monitors are generating Event code 2500
2600Communication errorUnexpected error occurred while sending {1} updates to {0}.{2}\nPlease look at the detection server controller logs for more information.Error: "Shipment task has exceeded maximum idle time of 540,000 milliseconds" with Communication error, Code: 2600
2705Configuration file {0} delivery completeSuccessfully transferred the config file {0} to the detection server.

New Cloud Detection or Cloud Email server added to DLP is not detecting any data uploads or accepting emails

2715Cloud Service is not available because of an account issueError {0}. Cloud Service is not available because of an account issue. Contact Symantec Support (https://support.symantec.com/en_US/contact-support.html).

You are seeing a FAIL_BINDING_ERROR on your Enforce Server after Cloud Services enrollment

Error code 2715: "Cloud Service is not available because of an account issue" in the Symantec DLP cloud server

2716Cloud detector disconnectedCloud detector disconnected. See the Cloud Service for Email Implementation Guide at http://www.symantec.com/docs/DOC9008 for details {0}.Error: "2716 Cloud detector disconnected" periodically in DLP Enforce
2905Exact data profile creation failedData file for exact data profile "{0}" was not created. Please look in the enforce server logs for more information.Event Code 2905 is being observed in the Enforce console
2927User Group "{0}" synchronization failedThe following User Group directories have been removed/renamed in the Directory Server and could not be synchronized:{1}\n\nPlease update the "{2}" User Group page to reflect such changes.Event Code 2905 is being observed in the Enforce console
2928One or more EDM profiles are out of date and must be reindexedCheck the "Manage > Data Profiles > Exact Data" page for more details. The following EDM profiles are out of date: {0}.
3000{0}{1} Document profile wasn''t created.Scheduled Indexing of a Network Share fails with Event Code 3000
3007Failed to remove orphaned file{0}Event Code 3007 - Failed to remove orphaned file in DLP
3100Invalid Attributes detected with Script Lookup PluginInvalid or unsafe Attributes passed from Standard In were removed during script execution. Review the logs for more details.Warning: The attributes below were stripped from the script arg list as they contain characters that are not permitted
3707Scan failed: Remediation detection catalog could not be updatedRemediation detection catalog update timed out after {0} milliseconds for target {1}.DLP Discover scan failed with code 3707
3901System events have been suppressed.System event throttle limit exceeded. {0} events have been suppressed. Internal error code = {1}.Error: "3901, System Events have been suppressed" in DLP Endpoint Prevent
4052Agent event batch persist errorEvent data for {0} agent(s) could not be persisted. Please look at the detection server controller logs for more information.Event Code 4052: "Event data for agent(s) could not be persisted" in DLP
4053Agent Time Update FailedAgent Time Update FailedWarning code 4053 'Agent Time Update Failed' found in Enforce Server events
4200Cloud Service enrollment: successfully received client certificate from Managed PKI ServiceCloud Service enrollment: successfully received client certificate from Managed PKI Service.DLP cloud detector in "Disconnected" status [Landing Page for enrollment errors]

Unable to write key store file "enforce_keystore.jks" when registering new Cloud Detection Server
4201Cloud Service enrollment: error requesting client certificate from Managed PKI ServiceError: {0} - {1}. This may be due either to an invalid enrollment bundle or a misconfiguration in the connection between the Enforce Server and a proxy. If you are not using a proxy please request a new bundle.DLP cloud detector in "Disconnected" status [Landing Page for enrollment errors]

DLP Cloud Service enrollment: error requesting client certificate from Symantec Managed PKI Service

Error during enrollment "trustAnchors parameter must be non-empty"

Cloud detector showing “disconnected” after bundle upload to Enforce
4202Cloud Service Renewal enrollment: error requesting client certificate from Managed PKI ServiceError: {0} - {1}. This may be due either to an invalid enrollment bundle or a misconfiguration in the connection between the Enforce Server and a proxy. If you are not using a proxy please request a new bundle.MPKI certificate errors in Servers and Detectors Overview for the Enforce Server
4205Managed PKI Service certificate expires in {0} daysManaged PKI Service certificate expires in {0} days.MPKI certificate errors in Servers and Detectors Overview for the Enforce Server
4206Managed PKI Service certificate has expiredManaged PKI Service certificate has expired.You are seeing the error: "Managed PKI Service certificate has expired" in DLP
4803OCR request was not successful{0}Enforce console Alert: 4803 OCR request was not successful - Image Size Error
5100Inductor {0} initialization failedInductor {0} initialization failed. Error: {1}Data Loss Prevention SMTP Prevent Diagnostic and troubleshooting
5101No inductors were initializedNo inductors were initializedData Loss Prevention SMTP Prevent Diagnostic and troubleshooting
5902DLP News synchronization failedDLP News synchronization failed. {0}Event Code 5902 on Enforce server. DLP Alerts synchronization failed. ConnectException : Connection refused: connect
6006{0} application data is not getting transmittedReplication of data between the Enforce and the detection server is stuck for application {0} due to an unknown error. The connection to Enforce will be reset.Event code 6006: EMDIProfile application data is not getting transmitted
6116Error sending execution matrix to AggregatorEnforce was unable to send an execution matrix(legacy 15.8 and earlier) matrix to an endpoint serverEvent Code 6116: Error sending execution matrix to Aggregator