Data Loss Prevention

 View Only
Expand all | Collapse all

Incident Persister Service keeps stopping

  • 1.  Incident Persister Service keeps stopping

    Posted Sep 08, 2011 06:35 AM

    Hi After using the upgrade manual wizard to upgrade our detection servers to version 11.1.1. The incident persister service does not start automatically.

    I had already run the wizard to upgrade the Enforce server, then went back into and re-run just to do the Detection servers. During the install got message say enforce already upgraded skipping to Detection Install.

    Now when I go to the Enforce GUI i get the following

     

    HTTP Status 404 -


    type Status report

    message

    description The requested resource () is not available.


    Apache Tomcat/5.5.30

    If I look at the services the Incident Persister service is not running if I start it manually then try starting GUI get the same error message and the Incident Persister service stops again.

     

     



  • 2.  RE: Incident Persister Service keeps stopping
    Best Answer

    Broadcom Employee
    Posted Sep 09, 2011 06:52 AM

    Hope the KB below can help you:

    Problem Summary
     
     

    After upgrading to DLP version 11, the Incident Persister service fails to start on the Enforce server.

    In some cases, IncidentPersister0.log contains the following error:

    Feb 4, 2011 3:06:39 PM (SEVERE) Thread: 10 [com.vontu.util.jdbc.JDBCLogger.<clinit>] Failed to initialize JDBC Logging
    java.io.IOException: Couldn't get lock for C:/Vontu/Protect/logs/debug/IncidentPersister_jdbc_%g.log

    Other reported manifestations include issues with custom attribute lookups, including system events ("Response rule execution failed") and the following errors in IncidentPersister_0.log:

    Apr 11, 2011 2:32:10 PM (SEVERE) Thread: 10 [com.vontu.incidenthandler.IncidentPersister.main] (INCIDENT_PERSISTER.6) An unrecoverable error occurred during the startup of the Incident Persister. The process will be terminated.
    com.vontu.incidenthandler.command.enforce.ResponseRuleServiceException: Could not start CustomAttributeLookup.

    Later in the log, the following error points to the ultimate cause:

    Caused by: java.lang.NullPointerException
     at com.vontu.util.jdbc.JDBCLogger.isLoggable(JDBCLogger.java:51)
     at com.vontu.util.jdbc.LoggingStatement.executeQuery(LoggingStatement.java:192)
    [etc.]

     


    Solution
     
     

    This problem is caused by an invalid path for JDBC logging by the Incident Persister service; it occurs even if JDBC logging was not previously enabled. Correct the path in the following variable located in \Vontu\Protect\config\IncidentPersisterLogging.properties :

    com.vontu.util.jdbc.JDBCLogHandler.Pattern