Remediation for failed migration at "StructuredDataIdentifierUpdate"
search cancel

Remediation for failed migration at "StructuredDataIdentifierUpdate"

book

Article ID: 442456

calendar_today

Updated On:

Products

Data Loss Prevention Data Loss Prevention API Detection Data Loss Prevention API Detection for Developer Apps Virtual Appliance Data Loss Prevention Cloud Detection Service Data Loss Prevention Cloud Detection Service for API Detection Data Loss Prevention Cloud Detection Service for Endpoint Data Loss Prevention Cloud Detection Service for ICAP Data Loss Prevention Cloud Detection Service for REST Data Loss Prevention Cloud Package Data Loss Prevention Cloud Prevent for Microsoft Office 365 Data Loss Prevention Cloud Service for Discovery/Connector Data Loss Prevention Cloud Service for Email Data Loss Prevention Cloud Storage Data Loss Prevention Core API Detection Data Loss Prevention Core Package Data Loss Prevention Data Access Governance Data Loss Prevention Discover Suite Data Loss Prevention Endpoint Discover Data Loss Prevention Endpoint Prevent Data Loss Prevention Enforce Data Loss Prevention Enterprise Suite Data Loss Prevention for Mobile Data Loss Prevention Form Recognition Data Loss Prevention Network Discover Data Loss Prevention Network Monitor Data Loss Prevention Network Monitor and Prevent for Email Data Loss Prevention Network Monitor and Prevent for Email and Web Data Loss Prevention Network Monitor and Prevent for Web Data Loss Prevention Network Prevent for Email Data Loss Prevention Network Prevent for Email Virtual Appliance Data Loss Prevention Network Prevent for Web Virtual Appliance Data Loss Prevention Network Protect Data Loss Prevention Oracle Standard Edition 2 Data Loss Prevention Plus Suite Data Loss Prevention Sensitive Image Recognition Data Loss Protection Oracle Standard Edition

Issue/Introduction

When upgrading to 16.1, 25.1 or 26.1 from any 16.X version the migrator fails at  "StructuredDataIdentifierUpdate"

SEVERE: Failed to execute migration actions. Please refer to the log file for details
com.symantec.dlp.migrationcommon.MigrationException: Failed to run migration action "DatabaseUpdate"
at com.symantec.dlp.migrationcommon.MigrationActionsExecutor.runMigrationAction(MigrationActionsExecutor.java:72)
at com.symantec.dlp.migrationcommon.MigrationActionsExecutor.executeMigrationActions(MigrationActionsExecutor.java:118)
at com.symantec.dlp.migrationcommon.MigrationUtility.runMigrationUtility(MigrationUtility.java:193)
at com.symantec.dlp.migrationcommon.MigrationUtility.runMigrationUtility(MigrationUtility.java:116)
at com.symantec.dlp.migrationcommon.MigrationUtility.runMigrationUtility(MigrationUtility.java:127)
at com.symantec.dlp.enforceservermigrationutility.EnforceServerMigrationUtility.runMigration(EnforceServerMigrationUtility.java:49)
Caused by: com.symantec.dlp.migrationcommon.MigrationException: com.symantec.dlp.migrationcommon.MigrationException: Migration SQL script failed with 2 errors
at com.symantec.dlp.enforceservermigrationutility.actions.DatabaseUpdateMigrationAction.runAction(DatabaseUpdateMigrationAction.java:98)
at com.symantec.dlp.migrationcommon.MigrationActionsExecutor.runMigrationAction(MigrationActionsExecutor.java:65)
... 5 more
Caused by: com.symantec.dlp.migrationcommon.MigrationException: Migration SQL script failed with 2 errors
....
 
Search the log for any "ORA" errors and the MigrationUtility.log  file will show:
 
.... 

ERROR        : ORA-01427: single-row subquery returns more than one row
====================================================================================================

TASK_ID     : 8
TASK_NAME   : Data Migration
BATCH_NUM   : 1
ERROR_TYPE  : FATAL
ERRANT_STMT :
ERROR        : ORA-20001: UpgradeSchema_Data_Migration.Data_Migration: User-Defined Exception
====================================================================================================

....

Cause

When upgrading from 15.8 to 16.X versions there was a failure in migration that was ignored, and SDIs did not get updated.

The Migrator to 25.1 expects these SDIs to be in a certain stat

Resolution

Revert the database to the backup from before the migration was attempted.

Once the database is reverted and the environment is restored, run the following steps:

12 Steps to upgrade to 16.1 if initial SDI data is missing

These steps assume that only the "Verify initial SDI Data exists" failed in the new URT.
If the customer hit this issue with upgrading to 25.1 or 26.1, they must first upgrade to 16.1 first using these steps. Once upgraded to 16.1 then they can upgrade to future versions without issue.
These steps use files in the attached CorrectMissingSDI.zip.

  1. Install 16.1 Enforce Server (if not already installed)
  2. Verify that latest URT passes with no errors except for the SDI initialization failure that triggered following these steps
  3. Find 16.1 Migrator files in the folder \EnforceServer\16.1.00000\Protect\Migrator\
  4. Replace EnforceServerMigrationPhase2.xml in that folder with Step-4_EnforceServerMigrationPhase2.xml.from16
    (after renaming it to EnforceServerMigrationPhase2.xml)
  5. Run the 16.1 Migrator running and completing both Phase1 and Phase 2 using your current 16.0.x version as the source version (as you would normally would)
    NOTE: This will perform all the normal migration actions to upgrade the schema to 16.1; however as defined in the XML will exit after the "DatabaseUpdate" action without completing the remaining actions that normally run
  6. If the 15.8 Enforce version is not still installed then perform the following steps but always replacing <CurrentDLPVersion> with your current DLP version of 16.0.00000, 16.0.10000, or 16.0.20000
      • Windows
        1. Export to a file the registry key KEY_LOCAL_MACHINE\SOFTWARE\Symantec\Data Loss Prevention\Enforce Server\<CurrentDLPVersion>\Installation
        2. Edit the exported registry file with a text editor and change the version path for the registry keys in the file with 15.8.00000
        3. Import the editied registry export to create the key
          HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Data Loss Prevention\Enforce Server\15.8.00000\Installation
          with the same values as your current install
      • Linux
        1. cp -a /etc/Symantec/DataLossPrevention/<CurrentDLPVersion>/. /etc/Symantec/DataLossPrevention/15.8.00000/
        2. cp -a /etc/Symantec/DataLossPrevention/EnforceServer/<CurrentDLPVersion>/. /etc/Symantec/DataLossPrevention/EnforceServer/15.8.00000/
      • Create the folder path DataLossPrevention\EnforceServer\15.8.00000\Protect\config\
      • Copy all files (and folders) from folder
        DataLossPrevention\EnforceServer\<CurrentDLPVersion>\Protect\config
        to the 15.8 config folder just created
  7. If the 16.1 migrator had been ran before then in the folder 
    \EnforceServer\16.1.00000\Protect\Migrator\SQL
    replace add_di_regex_pattern.sql and update_di_prepost_valid_characters.sql  with Step-7_add_di_regex_pattern.sql.clean and Step-7_update_di_prepost_valid_characters.sql.clean
    (after updating the extension .sql.clean to .sql)
  8. Replace EnforceServerMigrationPhase2.xml again now with Step-8_Step-11_EnforceServerMigrationPhase2.xml.final (after renaming it to EnforceServerMigrationPhase2.xml)
  9. Run the following SQL using the protect login to your Oracle database used for DLP
UPDATE dataidentifierbreadth SET preinvalidcharacters = '\S\w' 
WHERE (preinvalidcharacters IS NULL or preinvalidcharacters='') AND dataidentifierid IN 
(SELECT dataidentifierid FROM dataidentifier WHERE identifiertype='CUSTOM'); 
UPDATE dataidentifierbreadth 
SET postinvalidcharacters = '\S\w' 
WHERE (postinvalidcharacters IS NULL or postinvalidcharacters='') AND dataidentifierid IN 
(SELECT dataidentifierid FROM dataidentifier WHERE identifiertype='CUSTOM'); 
COMMIT;

      10. Run the 16.1 Migrator again once again skipping phase 1 and just running phase 2 but this time using 15.8 as the source version

      11. Replace EnforceServerMigrationPhase2.xml one final time with EnforceServerMigrationPhase2.xml.final (after renaming it to EnforceServerMigrationPhase2.xml)

      12. Run the 16.1 Migrator one last time again skipping phase 1 and just running phase 2 once again using your current 16.0.x version as the source version to complete the upgrade to 16.1

Attachments

CorrectMissingSDI.zip get_app
Powered by Wolken Software