Offense Notifications for JSA Appliances
Magistrate is Unable to Persist Offense Updates
38750147 - Magistrate encountered serious
errors that may prevent offenses from being updated.
Explanation
The system detected an exception when it wrote offense updates to the database.
Events are processed and stored, but they might not contribute to offenses.
User Response
Conduct a soft clean of the SIM data model with Deactivate offenses unchecked.
Click the Admin tab.
On the toolbar, click Advanced >Clean SIM Model.
Click Soft Clean to set the offenses to inactive.
Ensure that Deactivate offenses is not checked.
Click the Are you sure you want to reset the data model? check box and click Proceed.
When you clean the SIM model, all existing offenses are closed. Cleaning the SIM model does not affect existing events and flows.
Maximum Active Offenses Reached
38750050 - MPC: Unable to create new
offense. The maximum number of active offenses has been reached.
Explanation
The system is unable to create offenses or change a dormant offense to an active offense. The default number of active offenses that can be open on your system is limited to 2500. An active offense is any offense that continues to receive updated event counts in the past five days or less.
User Response
Select one of the following options:
Change low security offenses from open or active to closed, or to closed and protected.
Tune your system to reduce the number of events that generate offenses.
To prevent a closed offense from being removed by your data retention policy, protect the closed offense.
Maximum Total Offenses Reached
38750051 - MPC: Unable to process offense.
The maximum number of offenses has been reached.
Explanation
By default, the process limit is 2500 active offenses and 100,000 overall offenses.
If an active offense does not receive an event update within 30 minutes, the offense status changes to dormant. If an event update occurs, a dormant offense can change to active. After five days, dormant offenses that do not have event updates change to inactive.
User Response
Select one of the following options:
Tune your system to reduce the number of events that generate offenses.
Adjust the offense retention policy to an interval at which data retention can remove inactive offenses.
To prevent a closed offense from being removed by your data retention policy, protect the closed offense.
To free disk space for important active offenses, change offenses from active to dormant.