DLP Detection Server Status shows as unknown after upgrading to DLP 16.1

Products

• Data Loss Prevention
• Data Loss Prevention Enforce
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Core Package

Issue/Introduction

On a 16.1 DLP Enforce system, a SystemEvent record with a null SystemEventParameter 'parameter' value originating from a detector cannot be persisted by the DLP Detection Server Controller service, leading to a never ending failure loop that will end up disconnecting the detector and showing its status as 'Unknown'.

Environment

DLP 16.1, 16.1 MP1, 16.1 MP2

Cause

A legacy defect that was fixed in version 25.1 is impacting release 16.1 when persisting system events to the database, only when such events have a 'null' (unknown) parameter. This is a rare situation as the vast majority of events that include parameters have all of these parameter values assigned (known) at runtime. This is the first time that this defect has been reported, while DLP 16.1 was released a year and a half ago. There is most likely a specific feature and/or runtime context that is leading to this uncommon situation. We have not identified yet what the triggering context is. The defect has a cascading effect that continuously blocks the persistence queue / processing of the Detection Server Controller process, resulting in a loss of processing of the data and events coming from the detectors.

Enforce MonitorController logs show the following:

Mar 5, 2026 7:43:56 AM com.symantec.dlp.enforcedomainservices.events.system.SystemEventLogger processUnsavedEvents
INFO: 0 previously unsaved SystemEvent(s) successfully persisted, 200 remaining
Mar 5, 2026 7:43:56 AM com.symantec.dlp.communications.applicationcommunicatorlayer.HomogeneousReceiverApplicationCommunicator$HomogeneousReceiverDataAcceptor$ApplicationProcessingTask run
WARNING: Unexpected exception occurred for ApplicationConnection [connectionType=UDS, connectionIdentifier=ConnectionIdentifierId [hostName=, port=], peerSoftwareVersion=16.1.200.60292, dataConnection=C-3(4a478a0f-0b7c-4569-8cf5-0e9caccd46a0), peerId=]
org.springframework.transaction.UnexpectedRollbackException: Transaction silently rolled back because it has been marked as rollback-only
    at org.springframework.transaction.support.AbstractPlatformTransactionManager.processCommit(AbstractPlatformTransactionManager.java:753)
    at org.springframework.transaction.support.AbstractPlatformTransactionManager.commit(AbstractPlatformTransactionManager.java:712)
    at org.springframework.transaction.interceptor.TransactionAspectSupport.commitTransactionAfterReturning(TransactionAspectSupport.java:654)
    at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:407)
    at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:119)
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
    at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:762)
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:707)
    at com.symantec.dlp.enforcedomainservices.events.system.SystemEventLogger$$EnhancerBySpringCGLIB$$fcca809d.logEvent(<generated>)
    at com.symantec.dlp.services.systemevent.SystemEventPersistingService.onReceived(SystemEventPersistingService.java:97)
    at com.symantec.dlp.services.systemevent.SystemEventPersistingService.onReceived(SystemEventPersistingService.java:46)
    at com.symantec.dlp.communications.applicationcommunicatorlayer.HomogeneousReceiverApplicationCommunicator$HomogeneousReceiverDataAcceptor$ApplicationProcessingTask.run(HomogeneousReceiverApplicationCommunicator.java:290)
    at com.symantec.dlp.util.concurrent.DeadlineTaskQueue$DeadlineTask.run(DeadlineTaskQueue.java:254)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:750)
Mar 5, 2026 7:43:56 AM com.symantec.dlp.communications.applicationcommunicatorlayer.ApplicationCommunicatorActivityNotifiableImpl onRetryUponRecoverableApplicationException
WARNING: OnRetry after encountering a recoverable applcation exception for ApplicationConnection [connectionType=UDS, connectionIdentifier=ConnectionIdentifierId [hostName=, port=], peerSoftwareVersion=16.1.200.60292, dataConnection=C-3(4a478a0f-0b7c-4569-8cf5-0e9caccd46a0), peerId=] and the replicatorId is Replicator(33,'SystemEvent'). Will retry in 10 seconds.
Mar 5, 2026 7:43:56 AM com.symantec.dlp.enforcedomainservices.events.system.SystemEventLogger processUnsavedEvents
WARNING: Failure to persist previously unsaved SystemEvent 

Resolution

Upgrade to DLP version 25.1 which does not have this issue.

Additional Information

Restarting the detection server services restores connectivity but only temporarily until the issue occurs again.