Event Parser fails to process events (Error Code: 2147467259)

技术文章 ID: KB93393
上次修改时间: 12/22/2021

环境

McAfee Data Loss Prevention (DLP) Endpoint 11.3.x
McAfee ePolicy Orchestrator (ePO) 5.10.x

问题

The ePO Event Parser fails to process DLP events.

EventParser_systemname.log:

20200915122202 E #00748 HOSTDLPEVENT Failed process event. Time elapsed: (in ms): 47
20200915122202 E #00748 EVNTPRSR source\server.cpp(1064): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20200915122202 I #00748 EVNTPRSR Requeueing D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221433892806000041E3.xml for retry
20200915122202 X #00748 EVNTPRSR source\server.cpp(1015): Processing <DLPPREV_1100>, D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221473935272000041E3.xml.
20200915122202 X #05128 EVNTPRSR source\server.cpp(1015): Processing <DLPPREV_1100>, D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221433892806000041E3.xml.
20200915122202 E #02216 HOSTDLPEVENT Error processing event. Error: SP: EPOEvents_InsertEvent2, Param: @AutoID. Error: The transaction log for database 'ePO_RGCMCAFEEEPO_Events' is full due to 'LOG_BACKUP'.. Error Code: -2147467259
20200915122202 E #02216 HOSTDLPEVENT Failed process event. Time elapsed: (in ms): 31
20200915122202 E #02216 EVNTPRSR source\server.cpp(1064): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20200915122202 I #02216 EVNTPRSR Requeueing D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221393824169000041E3.xml for retry
20200915122202 X #02216 EVNTPRSR source\server.cpp(1015): Processing <DLPPREV_1100>, D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221393824169000041E3.xml.
20200915122202 X #05128 EPODAL ePOData_Connection.cpp(590): ssl Authenticate mode is 1
20200915122202 X #05128 HOSTDLPEVENT Start processing event using ProcessEvent(LPUNKNOWN DBConnection, LPUNKNOWN XMLDoc)
20200915122202 E #05176 HOSTDLPEVENT Error processing event. Error: SP: EPOEvents_InsertEvent2, Param: @AutoID. Error: The transaction log for database 'ePO_RGCMCAFEEEPO_Events' is full due to 'LOG_BACKUP'.. Error Code: -2147467259
20200915122202 E #05176 HOSTDLPEVENT Failed process event. Time elapsed: (in ms): 32
20200915122202 E #05176 EVNTPRSR source\server.cpp(1064): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20200915122202 E #05176 EVNTPRSR source\server.cpp(1128): Failed to process file D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221153514546000041E3.xml, XML file error count 41899
20200915122202 X #00748 EPODAL ePOData_Connection.cpp(590): ssl Authenticate mode is 1

In the Windows Event Viewer, the Event ID: 9002 is generated under the Application log.

Error:

Log Name: Application
Source: MSSQLSERVER
Date: 9/15/2020 1:57:37 PM
Event ID: 9002
Task Category: Server
Level: Error
Keywords: Classic
User: N/A
Computer: RGCMCAFEEEPO

Description:

The transaction log for database 'ePO_RGCMCAFEEEPO_Events' is full due to 'LOG_BACKUP'.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MSSQLSERVER" />
<EventID Qualifiers="49152">9002</EventID>
<Level>2</Level>
<Task>2</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-09-15T05:57:37.882937400Z" />
<EventRecordID>3206441</EventRecordID>
<Channel>Application</Channel>
<Computer>RGCMCAFEEEPO</Computer>
<Security />
</System>
<EventData>
<Data>ePO_RGCMCAFEEEPO_Events</Data>
<Data>LOG_BACKUP</Data>
<Binary>2A230000110000000E000000530044004300500057004D004300410046004500450044004200000013000000650050004F005F00530044004300500057004D0043004100460045004500450050004F000000</Binary>
</EventData>
</Event>

原因

The transaction log is FULL and there is no space in the partition to write the data for ePO_Events DB, Log file [.LDF file]. So, the SQL Error Log 9002 is triggered.

解决方案

The transaction Log file is saved on the disk drive. You must free the disk space that contains the Log file.

To create space in the drive, delete or move other files.

The free space on the disk allows it to perform other tasks and resolves SQL Error Log 9002 The Transaction Log for Database is Full.

For more information about LOG_BACKUP, see https://docs.microsoft.com/en-us/sql/relational-databases/logs/the-transaction-log-sql-server?view=sql-server-ver15

To check the partition of the LDF file for ePO_Events DB stored:

Make a backup of the ePO database. See KB52126 for details.
Log on to SQl Management Studio.
Expand Databases in Object Explorer.
Right-click on the database name for your ePO server and select New Query. For details, see KB67591.
Paste the script provided into the query window.
Click Execute or press the F5 key.

SP_helpdb ePO_XXXXXXXXX_Events

Example: SP_helpdb ePO_RGCMCAFEEEPO_Events

NOTE: This script helps to check the partition and size of each MDF, NDF, and LDF file.

受影响的产品

ePolicy Orchestrator 5.10.x

语言:

此文章有以下语言版本：

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

技术术语词汇表

突出显示词汇表术语

请花点时间浏览一下我们的技术术语词汇表。

Knowledge Center

Event Parser fails to process events (Error Code: 2147467259)

环境

问题

原因

解决方案

受影响的产品

语言:

技术术语词汇表

Title

Title

Knowledge Center

Event Parser fails to process events (Error Code: 2147467259)

环境

问题

原因

解决方案

受影响的产品

语言:

技术术语词汇表

选择您的区域

Title

Title