KBI 311177 Issue Addressed: BI Insert Error Might Happen For Security Audit Events Of User Account And Computer Management
Version
Argent for Compliance 3.1A-1501-T3 and earlier
Date
Thursday, 12 March 2015
Summary
When Bulk Insert is turned ON in Argent for Compliance, Security Audit Events for user account and computer management might not be saved properly
The issue can be identified by accumulation of DAT files in LOG_ARC_BI_DATA folder
The file names are in the format of ARGSOFT_COMPLIANCE_AUDIT_ACCOUNT_MANAGEMENT_xxxx_xxxx.DAT or ARGSOFT_COMPLIANCE_AUDIT_COMPUTER_MANAGEMENT_xxxx_xxxx.DAT
Further checking Service Log, Bulk Insert errors are logged for the same files
The issue has been addressed in Argent for Compliance 3.1A-1501-T4
Technical Background
The issue is caused by some fields in user or Computer Management Audit Event contains row delimiter for Bulk Insert
If they are not properly escaped, the format of Bulk Insert data is destroyed
As a result, the Bulk Insert fails
Resolution
Upgrade to Argent AT 3.1A-1501-T4 or later