Data Loss Prevention

 View Only

  • 1.  Event System events have been suppressed - DLP 14.6 MP1

    Posted Nov 17, 2017 02:30 PM

    Hello,

    I need your assist from the folowing warning event in the enforce console:

    Message
    Code 3901
    Summary System events have been suppressed.
    Detail System event throttle limit exceeded. 1 events have been suppressed. Internal error code = communications_error.     

    This warning reference to the endpoint server and I like to now the cause of this event.

     

     

     

     



  • 2.  RE: Event System events have been suppressed - DLP 14.6 MP1

    Posted Nov 21, 2017 09:14 AM

    Hi Tokyo2040. I've seens this event many times before. On the enforce server, there are multiple Config files. Out of which the Communication.properties, AggregatorLogging.properties and the Aggregator.properties mostly control the transport and data flow settings for events, log and alerts.

    There are some log Dampening and Aggregation settings in place to avoid log flooding.

    Sometimes an event for example, attempt to restart some process occur too many times in a given time window like 20 times in 3 seconds. In this case, only 3 events would be reported instead of 20. So 17 events would be dampened. We could also list (club) all 3 events in a single event/notification as per the Aggregator config.

    Hope this helps!