You see the following error for your Data Loss Prevention(DLP) Endpoint Prevent server and want more information on what this error means.
System events have been suppressed.
System event throttle limit exceeded. nnn events have been suppressed. Internal error code = communications_error.
Log into the Enforce console and click on the “System” tab.
The System > Servers and Detectors > Overview page opens.
From this page click on your Endpoint Detection Server.
The 3901 error is located in either the “Recent Error and Warning Events” or “All Recent” events box.
Note: You may need to click on show all to view a longer list of errors and events.
Next check your Aggregator#.log on your Endpoint Server for the following error:
java.lang.IllegalArgumentException: Programming error. Received an acknowledgement for successful replication of
For the location of the Aggregator log refer to the Debug log files Symantec help page.
The 3901 error is normally seen when the system is flooded with numerous agent events. To avoid log flooding, the server dampens these events resulting in the 3901 error. The 3901 error is normally associated with a known issue related to DLP 15.0 MP1 where agent events are excessively duplicated.
If the version of DLP you use is 15.0 MP1, refer to ALERT2576 to apply the required hot fix. If you are not running 15.0 MP1 or the hot fix does not resolve the 3901 error, please contact Symantec Support for additional assistance.
Subscribing will provide email updates when this Article is updated. Login is required.