The CA Data Protection (DataMinder) offers context search functionality. When viewing search results, you can zero in on an individual event and then view the events captured immediately before and after it. This can be useful if, for example, you want to trace the activity of an individual user over a particular period or if you want to follow the trail of Web activity that culminated in a warning or blocking. An issue has been identified where the iConsole Context search may fail to provide related events for reviewers running under Management or Hybrid security models.
The iConsole returns an error like the one below:
Message: The query with ID=kf3pcknie3duqfus1awp3wrh:Results:00000007 failed to run successfully:
Column 'event_uid' is constrained to be unique. Value '170096268' is already present..
The failure is logged in the iConsole logs with an error similar to the one below:
Feb 12, 2015 12:43:37.621MyDomain\AndrewDI1967Executing Search system/Event ID Context Search SP=Wgn_iConsole.Context_Search_V1_1 ID=2tviqvm52mqnopvybeh11i55:Results:0000000b Parameters: Event UID:=28188713 Event Timestamp:=Jan 01, 1970 00:00:01 UTC Participant Index:=0 No of Events Before/After:=1 Days Before/After:=1 Debug Log:=false TZ=GMT Standard Time
Feb 12, 2015 12:43:39.759MyDomain\AndrewDE19FFAn unexpected Exception was thrown: "Column 'event_uid' is constrained to be unique. Value '28188' is already present." at System.Data.UniqueConstraint.CheckConstraint(DataRow row, DataRowAction action) at System.Data.DataTable.RaiseRowChanging(DataRowChangeEventArgs args, DataRow eRow, DataRowAction eAction, Boolean fireEvent) at System.Data.DataTable.SetNewRecordWorker(DataRow row, Int32 proposedRecord, DataRowAction action, Boolean isInMerge, Int32 position, Boolean fireEvent, Exception& deferredException) at System.Data.DataTable.InsertRow(DataRow row, Int64 proposedID, Int32 pos, Boolean fireEvent) at System.Data.DataRowCollection.Add(DataRow row) at WgnWebSearchResults.CWgnWebSearchResults.CreateRowTable(String sSession, CErrorInfo* Err, String sSearchID, Int32 iSKey, XmlElement pSearch, IWgnDBResultSet* iResultSet, CDbResultSet* pDbRS, DataSet ds, Boolean bCheckSID, Boolean bVariant, UInt32 dwMaxRows, Int32 dbtype, UInt32* dwRecordCount, UInt32* dwExpectedRecordCount, UInt32* dwTotalRecordCount, Boolean* bCapped) InnerException:
Feb 12, 2015 12:43:39.774MyDomain\AndrewDE1913The query with ID=2tviqvm52mqnopvybeh11i55:Results:0000000b failed to run successfully:Column event_uid' is constrained to be unique. Value '28188' is already present..