Duplicate event id error when doing a context search on some events

Products

• CA Security Command Center
• CA Data Protection (DataMinder)
• CA User Activity Reporting

Issue/Introduction

The CA Data Protection (DataMinder) offers context search functionality.  When viewing search results, you can zero in on an individual event and then view the events captured immediately before and after it. This can be useful if, for example, you want to trace the activity of an individual user over a particular period or if you want to follow the trail of Web activity that culminated in a warning or blocking.  An issue has been identified where the iConsole Context search may fail to provide related events for reviewers running under Management or Hybrid security models.

The iConsole returns an error like the one below:

Message: The query with ID=kf3pcknie3duqfus1awp3wrh:Results:00000007 failed to run successfully: 
Column 'event_uid' is constrained to be unique. Value '170096268' is already present.. 

The failure is logged in the iConsole logs with an error similar to the one below:

Feb 12, 2015 12:43:37.621MyDomain\AndrewDI1967Executing Search system/Event ID Context Search SP=Wgn_iConsole.Context_Search_V1_1 ID=2tviqvm52mqnopvybeh11i55:Results:0000000b Parameters: Event UID:=28188713 Event Timestamp:=Jan 01, 1970 00:00:01 UTC Participant Index:=0 No of Events Before/After:=1 Days Before/After:=1 Debug Log:=false TZ=GMT Standard Time 

Feb 12, 2015 12:43:39.759MyDomain\AndrewDE19FFAn unexpected Exception was thrown: "Column 'event_uid' is constrained to be unique. Value '28188' is already present." at System.Data.UniqueConstraint.CheckConstraint(DataRow row, DataRowAction action) at System.Data.DataTable.RaiseRowChanging(DataRowChangeEventArgs args, DataRow eRow, DataRowAction eAction, Boolean fireEvent) at System.Data.DataTable.SetNewRecordWorker(DataRow row, Int32 proposedRecord, DataRowAction action, Boolean isInMerge, Int32 position, Boolean fireEvent, Exception& deferredException) at System.Data.DataTable.InsertRow(DataRow row, Int64 proposedID, Int32 pos, Boolean fireEvent) at System.Data.DataRowCollection.Add(DataRow row) at WgnWebSearchResults.CWgnWebSearchResults.CreateRowTable(String sSession, CErrorInfo* Err, String sSearchID, Int32 iSKey, XmlElement pSearch, IWgnDBResultSet* iResultSet, CDbResultSet* pDbRS, DataSet ds, Boolean bCheckSID, Boolean bVariant, UInt32 dwMaxRows, Int32 dbtype, UInt32* dwRecordCount, UInt32* dwExpectedRecordCount, UInt32* dwTotalRecordCount, Boolean* bCapped) InnerException: 

Feb 12, 2015 12:43:39.774MyDomain\AndrewDE1913The query with ID=2tviqvm52mqnopvybeh11i55:Results:0000000b failed to run successfully:Column event_uid' is constrained to be unique. Value '28188' is already present.. 

Environment

Release: ODLPSD05900-15.2-Data Protection-for Stored Data
Component:

Cause

An erroneous join was identified in the underlying SQL code which resulted in duplicate entries causing the search to fail.

Resolution

This issue is addressed in CA Data Protection (DataMinder) 14.5 via FIX:RO88916 (incorporating Reports_14.5_HF0188) and in CA Data Protection 15.2 via FIX:SO01433 (incorporating Reports_15.20_HF0172.zip).  After applying fix the context search executes as expected and the relevant results are displayed in the iConsole.

 

Additional Information

The fixes are available to download from the CA Support Portal (http://support.ca.com)