Data Loss Prevention

Hello

sometimes we received event code 1802 which is linked to "Corrupted incident received" and a .bad file is generated on enforce server.

Is there any common reason for such message and how we can use .bad file to reprocess or insert these incidents in DLP ?

 Regards

There are several causes of corrupted incidents, but by far the most common is the lack of sufficient tablespace to store incidents in the Oracle database. In this case, incidents from all detection servers will generate the "corrupted incident received" error.

So, you can check the usage of your tablespace firstly.

check this article

Article ID: 54212

thanks.

we have no issue with DB, and all our corrupted incident came from same network monitor. so i think it is related to network issues. We will investigate more on this point.

Stephane,

If you have a support contract, open up a ticket. We can analyse a packet capture from this server and let you know if the SPAN/TAP port is misconfigured. (Duplicate traffic, jumbo packets, dropped packets, etc...)

Best,

Ryan

hi pete,

do you have the link address on this

thank you

https://kb-vontu.altiris.com/

serach the article id after login.

hi,

thank you, i will check this article.