You want to see a table of DLP System Event Codes with knowledgebase articles
search cancel

You want to see a table of DLP System Event Codes with knowledgebase articles

book

Article ID: 396182

calendar_today

Updated On:

Products

Data Loss Prevention Data Loss Prevention API Detection Data Loss Prevention Cloud Detection Service Data Loss Prevention Cloud Detection Service for ICAP Data Loss Prevention Cloud Detection Service for REST Data Loss Prevention Cloud Package Data Loss Prevention Cloud Service for Email Data Loss Prevention Cloud Storage Data Loss Prevention Core Package Data Loss Prevention Data Access Governance Data Loss Prevention Discover Suite Data Loss Prevention Endpoint Discover Data Loss Prevention Endpoint Prevent Data Loss Prevention Enforce Data Loss Prevention Enterprise Suite Data Loss Prevention Form Recognition Data Loss Prevention Network Discover Data Loss Prevention Network Monitor Data Loss Prevention Network Monitor and Prevent for Email Data Loss Prevention Network Monitor and Prevent for Email and Web Data Loss Prevention Network Monitor and Prevent for Web Data Loss Prevention Network Prevent for Email Data Loss Prevention Network Protect Data Loss Prevention Oracle Standard Edition 2 Data Loss Prevention Plus Suite Data Loss Prevention Sensitive Image Recognition

Issue/Introduction

You've seen the 25.1 System Event Codes and Messages list in the TechDocs, but want to know if there are KB articles about specific codes in DLP.

 

Environment

25.x and 16.x Supported releases

Resolution

The below table provides a known list of KB articles for issues related to specific Event Codes returned in the DLP Enforce Console management server.

Code
Summary
Description
KB(s) written for this specific error
1008 {0} is down {0} process went down before it had fully started. RequestProcessor Status fails to start with event code 1008
1213 {0} messages timed out in Detection recently {0} messages timed out in Detection in the last {1} minutes. Enable Detection execution trace logs for details. Event code 1213 "Messages timed out in detection"
1214 Detected regular expression rules with invalid patterns Policy set contains regular expression rule(s) with invalid patterns. See FileReader%.log for details DLP 15.8 Event Code 1214 appears
1216 The Execution Matrix has reached the memory limit of {0} MBs or the Endpoint Server didn't have enough memory to handle it. The Execution Matrix has reached the set memory limit or the Endpoint Server didn't have enough memory to handle and ship it. Legacy Agents will not receive new policies until they get upgraded or the policy set is simplified. About policy distribution to agents prior to 16.0+ agent deployment
1302 File Reader failed to start Error starting File Reader. {0} No incidents will be detected. Event Code 1302 - Error starting File Reader. Failed to create server socket on address:port - 0.0.0.0:1344. No incidents will be detected.
1409 Icap secure keystore certificate about to expire soon

This shows that a certificate in the keystore is about to expire

Console showing "Error code 1409: Icap secure keystore certificate about to expire soon"

1803 Policy misconfigured Policy "{0}" has no associated severity. Event Code 1803 Policy has no associated severity
1806 Response rule processing failed to start Response rule processing failed to start: {0}. Enforce error code 1806 - Response rule processing failed to start: initialization failed.
1807 Response rule command runtime execution failed More detail as to the cause should be provided in the error Enforce Server displays error "1807 - Response rule command runtime execution failed from error: Error executing command: notify"
1818 Incident is oversized has been persisted with a limited number of components and/or violations Incident is oversized has been partially persisted with messageID {0} Incident File Name {1} Enforce Shows System Event Code 1818 - "Incident is oversized"
1821 Failure to process an incident received from the cloud gateway. Unexpected error occurred while processing incident received from cloud gateway. Code 1821 Failure to process an incident received from the cloud gateway Unexpected Error Processing Incident
2115 Custom attribute lookup failed Failed to instantiate lookup plug-in {0}. It was unloaded. Error message: {1} Error: "2115 - Custom attribute lookup failed" in DLP Detector Detail
2301 Tablespace is almost full Oracle tablespace {0} is over {1}% full. Oracle tablespace (LOB_TABLESPACE, USERS, etc.) for DLP is full, almost full, or critically full
2317 Failed to send incident email notification Email notification was not sent for Incident "{0}" and Policy "{1}". {2} DLP Event Code 2317 - Failed to send incident email notification with no recipients defined
2318 Incident deletion flagging process started. Incident deletion flagging process started. Troubleshooting automatic incident deletion flagging
2319 Incident deletion flagging process ended. Incident deletion flagging process ended.
2405 Unable to run scheduled report The scheduled report {0} owned by {1} encountered an error: {2}. Scheduled report fails to send
2500 Unexpected Error Processing Message Message chain #{0} encountered an unexpected error processing a message. See the log file for details. Network Monitors are generating Event code 2500
2600 Communication error Unexpected error occurred while sending {1} updates to {0}.{2}\nPlease look at the detection server controller logs for more information. Error: "Shipment task has exceeded maximum idle time of 540,000 milliseconds" with Communication error, Code: 2600
2705 Configuration file {0} delivery complete Successfully transferred the config file {0} to the detection server.

New Cloud Detection or Cloud Email server added to DLP is not detecting any data uploads or accepting emails

2715 Cloud Service is not available because of an account issue Error {0}. Cloud Service is not available because of an account issue. Contact Symantec Support (https://support.symantec.com/en_US/contact-support.html).

You are seeing a FAIL_BINDING_ERROR on your Enforce Server after Cloud Services enrollment

Error code 2715: "Cloud Service is not available because of an account issue" in the Symantec DLP cloud server

2716 Cloud detector disconnected Cloud detector disconnected. See the Cloud Service for Email Implementation Guide at http://www.symantec.com/docs/DOC9008 for details {0}. Error: "2716 Cloud detector disconnected" periodically in DLP Enforce
2905 Exact data profile creation failed Data file for exact data profile "{0}" was not created. Please look in the enforce server logs for more information. Event Code 2905 is being observed in the Enforce console
2927 User Group "{0}" synchronization failed The following User Group directories have been removed/renamed in the Directory Server and could not be synchronized:{1}\n\nPlease update the "{2}" User Group page to reflect such changes. Event Code 2905 is being observed in the Enforce console
2928 One or more EDM profiles are out of date and must be reindexed Check the "Manage > Data Profiles > Exact Data" page for more details. The following EDM profiles are out of date: {0}.
3000 {0} {1} Document profile wasn''t created. Scheduled Indexing of a Network Share fails with Event Code 3000
3007 Failed to remove orphaned file {0} Event Code 3007 - Failed to remove orphaned file in DLP
3100 Invalid Attributes detected with Script Lookup Plugin Invalid or unsafe Attributes passed from Standard In were removed during script execution. Review the logs for more details. Warning: The attributes below were stripped from the script arg list as they contain characters that are not permitted
3707 Scan failed: Remediation detection catalog could not be updated Remediation detection catalog update timed out after {0} milliseconds for target {1}. DLP Discover scan failed with code 3707
3901 System events have been suppressed. System event throttle limit exceeded. {0} events have been suppressed. Internal error code = {1}. Error: "3901, System Events have been suppressed" in DLP Endpoint Prevent
4052 Agent event batch persist error Event data for {0} agent(s) could not be persisted. Please look at the detection server controller logs for more information. Event Code 4052: "Event data for agent(s) could not be persisted" in DLP
4053 Agent Time Update Failed Agent Time Update Failed Warning code 4053 'Agent Time Update Failed' found in Enforce Server events
4200 Cloud Service enrollment: successfully received client certificate from Managed PKI Service Cloud Service enrollment: successfully received client certificate from Managed PKI Service. DLP cloud detector in "Disconnected" status [Landing Page for enrollment errors]

Unable to write key store file "enforce_keystore.jks" when registering new Cloud Detection Server
4201 Cloud Service enrollment: error requesting client certificate from Managed PKI Service Error: {0} - {1}. This may be due either to an invalid enrollment bundle or a misconfiguration in the connection between the Enforce Server and a proxy. If you are not using a proxy please request a new bundle. DLP cloud detector in "Disconnected" status [Landing Page for enrollment errors]

DLP Cloud Service enrollment: error requesting client certificate from Symantec Managed PKI Service

Error during enrollment "trustAnchors parameter must be non-empty"

Cloud detector showing “disconnected” after bundle upload to Enforce
4202 Cloud Service Renewal enrollment: error requesting client certificate from Managed PKI Service Error: {0} - {1}. This may be due either to an invalid enrollment bundle or a misconfiguration in the connection between the Enforce Server and a proxy. If you are not using a proxy please request a new bundle. MPKI certificate errors in Servers and Detectors Overview for the Enforce Server
4205 Managed PKI Service certificate expires in {0} days Managed PKI Service certificate expires in {0} days. MPKI certificate errors in Servers and Detectors Overview for the Enforce Server
4206 Managed PKI Service certificate has expired Managed PKI Service certificate has expired. You are seeing the error: "Managed PKI Service certificate has expired" in DLP
4803 OCR request was not successful {0} Enforce console Alert: 4803 OCR request was not successful - Image Size Error
5100 Inductor {0} initialization failed Inductor {0} initialization failed. Error: {1} Data Loss Prevention SMTP Prevent Diagnostic and troubleshooting
5101 No inductors were initialized No inductors were initialized Data Loss Prevention SMTP Prevent Diagnostic and troubleshooting
5902 DLP News synchronization failed DLP News synchronization failed. {0} Event Code 5902 on Enforce server. DLP Alerts synchronization failed. ConnectException : Connection refused: connect
6006 {0} application data is not getting transmitted Replication of data between the Enforce and the detection server is stuck for application {0} due to an unknown error. The connection to Enforce will be reset. Event code 6006: EMDIProfile application data is not getting transmitted
6116 Error sending execution matrix to Aggregator Enforce was unable to send an execution matrix(legacy 15.8 and earlier) matrix to an endpoint server Event Code 6116: Error sending execution matrix to Aggregator