Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Offense Notifications for JSA Appliances

 

Magistrate is Unable to Persist Offense Updates

38750147 - Magistrate encountered serious errors that may prevent offenses from being updated.

Explanation

The system detected an exception when it wrote offense updates to the database.

Events are processed and stored, but they might not contribute to offenses.

User Response

Conduct a soft clean of the SIM data model with Deactivate offenses unchecked.

  1. Click the Admin tab.

  2. On the toolbar, click Advanced >Clean SIM Model.

  3. Click Soft Clean to set the offenses to inactive.

  4. Ensure that Deactivate offenses is not checked.

  5. Click the Are you sure you want to reset the data model? check box and click Proceed.

When you clean the SIM model, all existing offenses are closed. Cleaning the SIM model does not affect existing events and flows.

Maximum Active Offenses Reached

38750050 - MPC: Unable to create new offense. The maximum number of active offenses has been reached.

Explanation

The system is unable to create offenses or change a dormant offense to an active offense. The default number of active offenses that can be open on your system is limited to 2500. An active offense is any offense that continues to receive updated event counts in the past five days or less.

User Response

Select one of the following options:

  • Change low security offenses from open or active to closed, or to closed and protected.

  • Tune your system to reduce the number of events that generate offenses.

    To prevent a closed offense from being removed by your data retention policy, protect the closed offense.

Maximum Total Offenses Reached

38750051 - MPC: Unable to process offense. The maximum number of offenses has been reached.

Explanation

By default, the process limit is 2500 active offenses and 100,000 overall offenses.

If an active offense does not receive an event update within 30 minutes, the offense status changes to dormant. If an event update occurs, a dormant offense can change to active. After five days, dormant offenses that do not have event updates change to inactive.

User Response

Select one of the following options:

  • Tune your system to reduce the number of events that generate offenses.

  • Adjust the offense retention policy to an interval at which data retention can remove inactive offenses.

    To prevent a closed offense from being removed by your data retention policy, protect the closed offense.

  • To free disk space for important active offenses, change offenses from active to dormant.