Version

Argent for Compliance 3.1A-1501-T3 and earlier

Date

Thursday, 12 March 2015

Summary

When Bulk Insert is turned ON in Argent for Compliance, Security Audit Events for user account and computer management might not be saved properly

The issue can be identified by accumulation of DAT files in LOG_ARC_BI_DATA folder

The file names are in the format of ARGSOFT_COMPLIANCE_AUDIT_ACCOUNT_MANAGEMENT_xxxx_xxxx.DAT or ARGSOFT_COMPLIANCE_AUDIT_COMPUTER_MANAGEMENT_xxxx_xxxx.DAT

Further checking Service Log, Bulk Insert errors are logged for the same files

The issue has been addressed in Argent for Compliance 3.1A-1501-T4

Technical Background

The issue is caused by some fields in user or Computer Management Audit Event contains row delimiter for Bulk Insert

If they are not properly escaped, the format of Bulk Insert data is destroyed

As a result, the Bulk Insert fails

Resolution

Upgrade to Argent AT 3.1A-1501-T4 or later