Agents send duplicate incidents
search cancel

Agents send duplicate incidents


Article ID: 207649


Updated On:


Data Loss Prevention Endpoint Suite Data Loss Prevention


You observe that agents send duplicate incidents.

In the IncidentPersister_(n) logs you see the following warning while persisting an incident that is a duplicate of one that has already been recevied.

(SEVERE) Thread: 96 [com.vontu.model.ojb.OJBLogger.error] Error while commit objects, do abort tx org.apache.ojb.odmg.TransactionImpl@654ece13, 
* SQLException during execution of sql-statement:
* sql statement was 'INSERT INTO Message (messageID,messageOriginatorID,messageSource,monitorID,monitorChannelType,messageDate ...
* Exception message is [ORA-00001: unique constraint (PROTECT.MESSAGE_U) violated]
The above warning is a safeguard that is working as designed to prevent a duplicate incident from the same endpoint discover scan from being persisted to the database.


This issue may occur under the following conditions:

  • The Agent Advanced setting is lower than the
  • The policy being used to detect the file is configured to retain the endpoint original message.
  • The file being detected is large enough to exceed the when being streamed by the agent to its Endpoint Server.


To prevent this issue from occurring:

  1. Navigate to System -> Agents -> Agent Configuration -> Advanced Settings
  2. Ensure that the (default of 270) setting is lower than the (default 300) setting.

Additional Information

See also: Key DLP agent and Endpoint Server communications settings