Duplicate event id error when doing a context search on some events

Document ID : KB000092344
Last Modified Date : 19/04/2018
Show Technical Document Details
Issue:

The CA Data Protection (DataMinder) offers context search functionality.  When viewing search results, you can zero in on an individual event and then view the events captured immediately before and after it. This can be useful if, for example, you want to trace the activity of an individual user over a particular period or if you want to follow the trail of Web activity that culminated in a warning or blocking.  An issue has been identified where the iConsole Context search may fail to provide related events for reviewers running under Management or Hybrid security models.

The iConsole returns an error like the one below:

Message: The query with ID=kf3pcknie3duqfus1awp3wrh:Results:00000007 failed to run successfully: 
Column 'event_uid' is constrained to be unique. Value '170096268' is already present.. 

The failure is logged in the iConsole logs with an error similar to the one below:

Feb 12, 2015 12:43:37.621MyDomain\AndrewDI1967Executing Search system/Event ID Context Search SP=Wgn_iConsole.Context_Search_V1_1 ID=2tviqvm52mqnopvybeh11i55:Results:0000000b Parameters: Event UID:=28188713 Event Timestamp:=Jan 01, 1970 00:00:01 UTC Participant Index:=0 No of Events Before/After:=1 Days Before/After:=1 Debug Log:=false TZ=GMT Standard Time 

Feb 12, 2015 12:43:39.759MyDomain\AndrewDE19FFAn unexpected Exception was thrown: "Column 'event_uid' is constrained to be unique. Value '28188' is already present." at System.Data.UniqueConstraint.CheckConstraint(DataRow row, DataRowAction action) at System.Data.DataTable.RaiseRowChanging(DataRowChangeEventArgs args, DataRow eRow, DataRowAction eAction, Boolean fireEvent) at System.Data.DataTable.SetNewRecordWorker(DataRow row, Int32 proposedRecord, DataRowAction action, Boolean isInMerge, Int32 position, Boolean fireEvent, Exception& deferredException) at System.Data.DataTable.InsertRow(DataRow row, Int64 proposedID, Int32 pos, Boolean fireEvent) at System.Data.DataRowCollection.Add(DataRow row) at WgnWebSearchResults.CWgnWebSearchResults.CreateRowTable(String sSession, CErrorInfo* Err, String sSearchID, Int32 iSKey, XmlElement pSearch, IWgnDBResultSet* iResultSet, CDbResultSet* pDbRS, DataSet ds, Boolean bCheckSID, Boolean bVariant, UInt32 dwMaxRows, Int32 dbtype, UInt32* dwRecordCount, UInt32* dwExpectedRecordCount, UInt32* dwTotalRecordCount, Boolean* bCapped) InnerException: 

Feb 12, 2015 12:43:39.774MyDomain\AndrewDE1913The query with ID=2tviqvm52mqnopvybeh11i55:Results:0000000b failed to run successfully:Column event_uid' is constrained to be unique. Value '28188' is already present.. 

Cause:
An erroneous join was identified in the underlying SQL code which resulted in duplicate entries causing the search to fail.
Resolution:
This issue is addressed in CA Data Protection (DataMinder) 14.5 via FIX:RO88916 (incorporating Reports_14.5_HF0188) and in CA Data Protection 15.2 via FIX:SO01433 (incorporating Reports_15.20_HF0172.zip).  After applying fix the context search executes as expected and the relevant results are displayed in the iConsole.

 
Additional Information:
The fixes are available to download from the CA Support Portal (http://support.ca.com)