DLP events aren't parsing or the SQL service is crashing with a stack dump in the SQL error logs

Technical Articles ID: KB92600
Last Modified: 2023-05-31 11:07:19 Etc/GMT

Environment

Data Loss Prevention Endpoint (DLP Endpoint) 11.x
ePolicy Orchestrator (ePO) 5.x

Problem 1

You see an error similar to the following in the SQL error log:

Error: 8646, Severity: 21, State: 1.
spid174 Unable to find index entry in index ID 1, of table 174115861, in database '<database name>'. The indicated index is corrupt or there is a problem with the current update plan. Run DBCC CHECKDB or DBCC CHECKTABLE. If the problem persists, contact product support.
spid146 **Dump thread - spid = 0, EC = 0x0000022076B0B810
spid146 ***Stack Dump being sent to D:\MSSQL\Program Files\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\LOG\SQLDump1056.txt
spid146 * *******************************************************************************
spid146 *
spid146 * BEGIN STACK DUMP:
spid146 * 06/16/21 14:54:55 spid 146
spid146 *
spid146 * CPerIndexMetaQS::ErrorAbort - Index corruption
spid146 *
spid146 * Input Buffer 170 bytes -
spid146 * 16 00 00 00 12 00 00 00 02 00 00 00 00 00 00 00 00 00
spid146 * U D L P _ C 01 00 00 00 1f 00 55 00 44 00 4c 00 50 00 5f 00 43 00
spid146 * l e a n C o m p u 6c 00 65 00 61 00 6e 00 43 00 6f 00 6d 00 70 00 75 00
spid146 * t e r P r o p e r 74 00 65 00 72 00 50 00 72 00 6f 00 70 00 65 00 72 00
spid146 * t i e s _ S P @ 74 00 69 00 65 00 73 00 5f 00 53 00 50 00 00 00 10 40
spid146 * m c A f e e A g e 00 6d 00 63 00 41 00 66 00 65 00 65 00 41 00 67 00 65
spid146 * n t G u i d $ ¢ 00 6e 00 74 00 47 00 75 00 69 00 64 00 00 24 10 10 a2
spid146 * ÜµD|ë < @ 95 dc b5 44 7c eb 11 3c 12 00 00 00 00 00 00 0c 40 00
spid146 * c o m p u t e r _ 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 5f 00
spid146 * id & 69 00 64 00 01 26 04 00

Problem 2

The "Event Parser" in ePO is unable to parse the DLP events and moves them to the "Debug" folder as seen below:

EventParser_systemname.log

20200305143912 X #09972 EVNTPRSR source\server.cpp(1015): Processing <DLPAGENT11200>, E:\Program Files (x86)\McAfee\Agent Handler\DB\Events\7abc6c8e-2090-4d3a-8c61-72b98f477e32-mc_202003051633028977091000021A0.xml.

20200305143912 X #09972 EPODAL ePOData_Connection.cpp(590): ssl Authenticate mode is 1

20200305143912 X #09972 HOSTDLPEVENT Start processing event using ProcessEvent(LPUNKNOWN DBConnection, LPUNKNOWN XMLDoc)

20200305143912 X #09972 HOSTDLPEVENT EPOEvents_InsertEvent2 returned AutoID 1447072515

20200305143912 E #10844 HOSTDLPEVENT Error processing event. Error: SP: UDLP_CleanComputerProperties_SP, Param: @computer_id. Error: Transaction (Process ID 97) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.. Error Code: -2147467259

20200305143912 E #10844 HOSTDLPEVENT Failed process event. Time elapsed: (in ms): 8781

20200305143912 E #10844 EVNTPRSR source\server.cpp(1064): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error

Cause

This issue is caused with a DLP-stored procedure named UDLP_CleanComputerProperties_SP. The issue happens because of the following line in this stored procedure:

DELETE FROM [dbo].[UDLP_RulesPerUser] WHERE [UDLP_RulesPerUser].user_id in (SELECT user_id FROM UDLP_UserProperties with(nolock) WHERE computer_id = @computer_id)

This statement causes a delete action on the data that's read with a 'nolock' hint, which can cause the index to become corrupted.

Solution

To resolve the issue, perform the following steps:

Take a full backup of the ePO Database (DB).

NOTE: You must take a backup before you continue.
Run the scripts mentioned in the attached UDLP_CleanComputerProperties_SP_v1.txt file.

NOTE: To run the script, make sure that both the SQLDUMP and Eventparser log content matches.
Run the scripts mentioned in the cleanUserSession.txt file.

Attachment 1

UDLP_CleanComputerProperties_SP_v1.sql
3K • < 1 minute @ broadband

Attachment 2

cleanUserSession.sql
86Bytes • < 1 minute @ broadband

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

DLP events aren't parsing or the SQL service is crashing with a stack dump in the SQL error logs

Environment

Problem 1

Problem 2

Cause

Solution

Attachment 1

Attachment 2

Affected Products

Languages:

Title

Title

Knowledge Center

DLP events aren't parsing or the SQL service is crashing with a stack dump in the SQL error logs

Environment

Problem 1

Problem 2

Cause

Solution

Attachment 1

Attachment 2

Affected Products

Languages:

Choose your region

Title

Title