Event Parser fails to process events (Error Code: 2147467259)

Technical Articles ID: KB93393
Last Modified: 2023-08-07 10:31:21 Etc/GMT

Environment

Data Loss Prevention (DLP) Endpoint 11.3.x
ePolicy Orchestrator (ePO) 5.10.x

Problem

The ePO Event Parser fails to process DLP events.

EventParser_systemname.log:

20200915122202 E #00748 HOSTDLPEVENT Failed process event. Time elapsed: (in ms): 47
20200915122202 E #00748 EVNTPRSR source\server.cpp(1064): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20200915122202 I #00748 EVNTPRSR Requeueing D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221433892806000041E3.xml for retry
20200915122202 X #00748 EVNTPRSR source\server.cpp(1015): Processing <DLPPREV_1100>, D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221473935272000041E3.xml.
20200915122202 X #05128 EVNTPRSR source\server.cpp(1015): Processing <DLPPREV_1100>, D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221433892806000041E3.xml.
20200915122202 E #02216 HOSTDLPEVENT Error processing event. Error: SP: EPOEvents_InsertEvent2, Param: @AutoID. Error: The transaction log for database 'ePO_RGCMCAFEEEPO_Events' is full due to 'LOG_BACKUP'.. Error Code: -2147467259
20200915122202 E #02216 HOSTDLPEVENT Failed process event. Time elapsed: (in ms): 31
20200915122202 E #02216 EVNTPRSR source\server.cpp(1064): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20200915122202 I #02216 EVNTPRSR Requeueing D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221393824169000041E3.xml for retry
20200915122202 X #02216 EVNTPRSR source\server.cpp(1015): Processing <DLPPREV_1100>, D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221393824169000041E3.xml.
20200915122202 X #05128 EPODAL ePOData_Connection.cpp(590): ssl Authenticate mode is 1
20200915122202 X #05128 HOSTDLPEVENT Start processing event using ProcessEvent(LPUNKNOWN DBConnection, LPUNKNOWN XMLDoc)
20200915122202 E #05176 HOSTDLPEVENT Error processing event. Error: SP: EPOEvents_InsertEvent2, Param: @AutoID. Error: The transaction log for database 'ePO_RGCMCAFEEEPO_Events' is full due to 'LOG_BACKUP'.. Error Code: -2147467259
20200915122202 E #05176 HOSTDLPEVENT Failed process event. Time elapsed: (in ms): 32
20200915122202 E #05176 EVNTPRSR source\server.cpp(1064): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20200915122202 E #05176 EVNTPRSR source\server.cpp(1128): Failed to process file D:\Program Files (x86)\DB\Events\6e49b989-2c50-44ed-8c35-ff6b741902df-mc_202009151221153514546000041E3.xml, XML file error count 41899
20200915122202 X #00748 EPODAL ePOData_Connection.cpp(590): ssl Authenticate mode is 1

In the Windows Event Viewer, the Event ID: 9002 is generated under the Application log.

Error:

Log Name: Application
Source: MSSQLSERVER
Date: 9/15/2020 1:57:37 PM
Event ID: 9002
Task Category: Server
Level: Error
Keywords: Classic
User: N/A
Computer: RGCMCAFEEEPO

Description:

The transaction log for database 'ePO_RGCMCAFEEEPO_Events' is full due to 'LOG_BACKUP'.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MSSQLSERVER" />
<EventID Qualifiers="49152">9002</EventID>
<Level>2</Level>
<Task>2</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-09-15T05:57:37.882937400Z" />
<EventRecordID>3206441</EventRecordID>
<Channel>Application</Channel>
<Computer>RGCMCAFEEEPO</Computer>
<Security />
</System>
<EventData>
<Data>ePO_RGCMCAFEEEPO_Events</Data>
<Data>LOG_BACKUP</Data>
<Binary>2A230000110000000E000000530044004300500057004D004300410046004500450044004200000013000000650050004F005F00530044004300500057004D0043004100460045004500450050004F000000</Binary>
</EventData>
</Event>

Cause

The transaction log is FULL and there's no space in the partition to write the data for ePO_Events DB, Log file [.LDF file]. So, the SQL Error Log 9002 is triggered.

Solution

The transaction Log file is saved on the disk drive. You must free the disk space that contains the Log file.

To create space in the drive, delete or move other files.

The free space on the disk allows it to perform other tasks and resolves SQL Error Log 9002 The Transaction Log for Database is Full.

For more information about LOG_BACKUP, see this Microsoft Support document.

To check the partition of the LDF file for the ePO_Events DB stored:

Make a backup of the ePO database. For details, see KB52126 - How to back up and restore the ePolicy Orchestrator database using SQL Server Management Studio.
Log on to SQL Management Studio.
Expand Databases in Object Explorer.
Right-click on the database name for your ePO server and select New Query. For details, see KB67591 - How to run a SQL script provided by Technical Support against the ePolicy Orchestrator database.
Paste the script provided into the query window.
Click Execute or press the F5 key.

SP_helpdb ePO_XXXXXXXXX_Events

Example: SP_helpdb ePO_RGCMCAFEEEPO_Events

NOTE: This script helps to check the partition and size of each MDF, NDF, and LDF file.

Affected Products

ePolicy Orchestrator 5.10.x

Languages:

This article is available in the following languages:

Knowledge Center

Event Parser fails to process events (Error Code: 2147467259)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Event Parser fails to process events (Error Code: 2147467259)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title