Event Code 6116: Error sending execution matrix to Aggregator
search cancel

Event Code 6116: Error sending execution matrix to Aggregator

book

Article ID: 399349

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent

Issue/Introduction

After upgrading Enforce and Detectors to 16.1+ the endpoint servers started reporting this alert:
Error 6116: Error sending execution matrix to Aggregator

Environment

16.1 servers with legacy(15.8.x and lower) agents. 

Cause

This is a new alert in DLP 16.1
It indicates that there was a failure to deliver the executoin matrix to the endpoint server. 
The most common cause is due to the execution matrix size exceeding what is set under System > Settings > General > Legacy Agents Policy Set Size Limit

Resolution

Verify an error similar to the following warning is present in the SymantecDLPDetector#.log files on the Endpoint Detector:

INFO: Estimating ###MBs for this matrix
com.vontu.policy.loader.execution.executiontree.integration.ExecutionTreeGenerator generate
WARNING: Limit of ###MBs exceeded, the matrix will not be created

If it is follow this KB to resolve the issue:
About policy distribution to agents prior to 16.0+ agent deployment

Additional Information

On 16.0.x this alert was also observed as code 1216 'The Execution Matrix has reached the memory limit of 200 MBs, or the endpoint server didn't have enough memory to handle it.' 
On 16.1 the 6116 error may encompass other root causes, such as a failure to read the POLICY topic on the endpoint server