Event code 1807: Response rule command runtime execution failed

Products

• Data Loss Prevention Core Package

Issue/Introduction

The DLP Enforce Console reports the following event code:
Event code 1807: Response rule command runtime execution failed 

Code 1807 <Date>
Response rule command runtime execution failed from error: Error executing command: set-status. 

Environment

Symantec Data Loss Prevention 16.1

Cause

Expected value in a response rule is invalid or null.

Resolution

Review DLP logs to find which incident and policy triggered Event 1807

1. On the Enforce Server, open the IncidentPersister#.log 
2. Search for the following:
   Error executing command: set-status
   
   Example result:
   File: Enforce\logs\debug\IncidentPersister_0.log
   Level: SEVERE
   Thread: 148
   Source: com.vontu.command.CommandRuntime.execute
   Message: Error executing command: set-status
   java.lang.NullPointerException
   
   
3. Pull the Thread # from the result above (Example: Thread: 148) and search 'up' in the IncidentPersister.logs for that thread for items BEFORE the "Error executing command: set-status" message. 
   
   Example:
   Search on "Thread: 148"
   
   Result: 
   File: Enforce\logs\debug\IncidentPersister_0.log
   Level: WARNING
   Thread: 148
   Source: com.vontu.logging.LocalLogWriter.write
   Message: Failed to send incident email notification. Email notification was not sent for Incident "#####" and Policy "<policy name>". No recipients specified for incident notification.
   
   
4. Review the incident and associated policy response rules to determine which expected items were null or invalid.