You are seeing the following error for your Data Loss Prevention(DLP) Endpoint Prevent server and want more information on what this error means.
System events have been suppressed.
System event throttle limit exceeded. nnnevents have been suppressed. Internal error code = communications_error.
Log into the Enforce console and click on the System tab.
This will open the System > Servers and Detectors > Overview page.
From this page click on your Endpoint Detection Server.
The 3901 error will be located in the Recent Error and Warning Events or All Recent events box. Note: You may need to click on show all to view a longer list of errors and events.
Next check your Aggregator#.log on your Endpoint server for the following error:
java.lang.IllegalArgumentException: Programming error. Received an acknowledgement for successful replication of
For the location of the Aggregator log refer to the Debug log files Symantec help page.
The 3901 error is normally seen when the system is flooded with numerous agent events. To avoid log flooding, the server dampens these events resulting in the 3901 error. The 3901 error is normally associated with a known issue related to DLP 15.0 MP1 where agent events are excessively duplicated.
If the version of DLP you are using is 15.0 MP1, refer to ALERT2576 to apply the required hotfix. If you are not running 15.0 MP1 or the hotfix does not resolve the 3901 error, please contact Symantec Support for additional assistance.
Subscribing will provide email updates when this Article is updated. Login is required to Subscribe