This appendix explains the messages that are reported in the Event Log. The use of the Event Log is explained in Section 15.7, "Working with the Event Log".
Table W-1 Explanation of Event Log Messages
Code | Message | Explanation |
---|---|---|
10000 |
Collector started successfully |
The Collector was started successfully by the system. |
10001 |
Collector exited normally |
The Collector exited on a scheduled condition (for instance, because it needs to apply configuration setting changes). |
10002 |
Collector exited, initialization failed |
The Collector exited during start up because of an unrecoverable configuration error. |
10003 |
Collector out of memory |
The Collector's memory usage exceeded the configured threshold. |
10004 |
Collector exited for other reason |
The Collector exited unexpectedly due to an unknown reason. |
10005 |
Collector exited on segmentation fault |
The Collector exited unexpectedly due to a program crash. |
10010 |
Collector started by watchdog |
The Collector was started by the watchdog process. This is most likely due to it having previously exited unexpectedly. |
10011 |
Collector stopped by watchdog |
The Collector was stopped by the watchdog process due to an error condition (for instance, the program ran out of memory or was hanging). The actual error is reported separately. |
10020 |
No interfaces suitable for traffic collection found |
The Collector cannot start because it cannot find a network interface that can be used for monitoring data. Typically, that is because the interface has an IP address. |
10030 |
Primary system unreachable: activating standby |
In a high-availability environment, the primary system has just became unreachable. The failover system will now become active and take over. |
10031 |
Standby system unreachable |
In a high-availability environment, the failover system has just became unreachable. |
10050 |
Configuration changes activated |
Any pending configuration changes have been successfully applied. |
10051 |
Traffic filter changes activated |
Configuration changes related to network traffic filters have been successfully applied. |
10052 |
Masking changes activated |
Configuration changes related to data masking have been successfully applied. |
10053 |
Content scan changes activated |
Configuration changes related to content (for instance, error strings and page-naming based on HTML Title) have been successfully applied. |
10054 |
App/Suite/Service definition changes activated |
Configuration changes related to any application, service, or suite definition have been successfully applied. |
10055 |
Oracle Forms changes activated |
Configuration changes related to Oracle Forms have been successfully applied. |
10056 |
Replay storage settings changes activated |
Configuration changes related to the size of the Replay data storage have been successfully applied. |
10060 |
Configuration changes trigger Collector restart |
The latest set of configuration changes require a Collector restart. This will be scheduled and executed by the system. |
10061 |
Traffic filter changes activated |
Configuration changes related to traffic filtering have been successfully applied. |
10066 |
Replay storage settings changes trigger Collector restart |
Configuration changes related to the size of the replay data storage required a restart of the Collector. |
10100 |
Content scan syntax error |
An internal sysntax error related to content scan pattern matching has occured. |
10101 |
Content scan of %1$s KB does not fit in %2$s KB memory limit |
A memory buffer was to small related to content scan pattern matching. Event log seen per scan per http request. |
10102 |
Content scan of %1$s KB does not fit in %2$s KB free content scan memory |
A memory buffer was to small related to content scan pattern matching. Event log seen per scan per http request. |
10103 |
Content scan of %s KB does not fit in global memory limit |
A memory buffer was to small related to content scan pattern matching. Event log seen per scan per http request. |
10104 |
Content scan loaded |
Informational message indicating the collector received and successfully applied new content scan configuration. |
10110 |
Failed to move log file to final name '%s' |
The temporary HTTP log file used for the current logging period could not be moved to its final location on disk. Typically, this is due to a write/access permission problem or a missing directory component in the path. |
10111 |
Failed to open new HTTP log file '%s' |
The Collector tried and failed to open a new HTTP log file for the next logging period. Typically, this is due to a write/access problem or a missing component in the directory path. |
10112 |
No HTTP/Forms ports configured. |
Informational message indicating no port configuration is found for HTTP/Forms. This is configured in Configuration > Security > protocols. |
10200 |
Collector exceeded %1$s KB memory limit by %2$s KB |
The Collector operates under a memory limit which is used to prevent it from consuming too much memory which may lead to a deterioration in the system's operation. This message indicates that the Collector exceeded the currently configured memory limit. Whenever this condition is detected, this message is reported and the Collector exits. |
10201 |
Collector approaching %1$s KB memory limit at %2$s KB |
The Collector operates under a memory limit which is used to prevent it from consuming too much memory which may lead to a deterioration in the system's operation. This message is a warning that the current memory used by the Collector is approaching the configured limit. |
10300 |
At hit time %1$s: POST variable truncated at %2$s bytes: %3$s |
The content of a POST message is buffered by the Collector during processing. This message is reported whenever a message exceeds the current internal buffer limit. |
10301 |
POST request truncated at %1$s of %2$s total bytes |
The content of a POST message is buffered by the Collector during processing. This message is reported whenever a message exceeds the current internal buffer limit. |
10400 |
Thread npa%1$s: no heartbeat seen. Restarting Collector |
A traffic processing thread in the Collector has locked up, probably due to an internal error. The Collector must be restarted in order to reset the thread. |
10500 |
Collector receiving too much traffic; dropping new connections to reduce load |
The Collector allocates memory that is used for processing traffic and queueing network packets while awaiting processing. When too much traffic is received, the queues can grow out of control. To prevent this, the Collector starts dropping any new TCP sessions. Note that existing sessions are still processed in order to manage the queues. |
10501 |
Collector receiving too much traffic; dropping all new data to reduce load |
The reduction of traffic load by dropping new TCP sessions did not alleviate the queue overload. To avoid running out of memory, the Collector will stop processing any new data, and will only process the packets currently in the queues. |
10502 |
Collector load under threshold; resuming normal data collection |
The packet queues have been drained sufficiently. The Collector is now ready to process all traffic again. |
10601 |
Dropping HTTP header %s: too many headers |
This message is reported whenever the number of configured custom headers in the Collector exceeds 64. Custom headers are generated by all RUEI configuration items that take their input from an HTTP header field (such as user IDs, custom dimensions, and web site errors). |
10700 |
Collector encountered frames upto %1$s bytes; suggested maximum frame size setting |
This message is reported whenever the collector encounters a packet that is larger is size then the current configured frame size. Action: Configure the frame size to the suggested value. This is done in Configuration > Security > Jumbo Frames |
19998 |
Internal error (%s). |
This message reports that a generic internal error occurred. |
19999 |
%s |
This message reports that a generic internal error occurred. |
20000 |
Message threshold (%1$s) exceeded |
The number of messages that a single process can generate in a short time is limited. This message indicates that the limit has been reached, and that no further messages are logged for the process. |
20001 |
Job exited with exit code %1$s (%2$s) |
A processing job failed (generic message). |
20002 |
Collector %1$s at %2$s is unreachable |
Reported when an SSH connection to the Collector to fetch its HTTP log files could not be made. |
20003 |
Rsync of %1$s failed with exit code %2$s (%3$s) |
The fetching of HTTP log files from the Collector failed. |
20004 |
Cannot connect to database |
One of the jobs could not make a database connection. |
20005 |
Cannot open file %1$s for reading |
A system file could not be opened (generic message). |
20006 |
Cannot open file %1$s for writing |
A system file could be written (generic message). |
20007 |
Database usage is less than the alert threshold (%1$s%%) |
Database usage has returned to a level below the configured alert threshold. |
20008 |
Database usage exceeds the current alert threshold (%1$s%%) |
The configured alert database usage threshold has been exceeded. It is recommended that you review the database's maximum size. |
20009 |
Database usage exceeds the current stop threshold (%1$s%%); data processing on hold |
The configured maximum database usage threshold has been exceeded. No further data will be written to the database until an administration mechanism has brought the database's size back to within its permitted boundary. |
20010 |
Disk usage is less than the alert threshold (%1$s%%) |
Disk space usage has returned to a level below the configured alert threshold. |
20011 |
Disk usage exceeds the current alert threshold (%1$s%%) |
The configured alert disk usage threshold has been exceeded. It is recommended that you review the system's disk space availability. |
20012 |
Disk usage exceeds the current stop threshold (%1$s%%) |
The configured maximum disk usage threshold has been exceeded. No further data will be written to the file system until an administration mechanism has brought the disk usage back to within its permitted boundary. |
20020 |
Rsync of %1$s still failing after %2$s hours with exit code %3$s (%4$s) |
Same as 20003. Repeated every hour while rsyncing log files from a Collector fails. |
20021 |
Still cannot connect to database after %1$s hours |
Same as 20004. Repeated every hour while connecting to the database fails. |
20022 |
Collector %1$s at %2$s still unreachable after %3$s hours |
Same as 20002. Repeated every hour while the SSH connection to a Collector fails. |
20030 |
Thread deadlock detected in the log file processor; forcing a core dump |
An internal error occurred in the processing of log files. Data processing is affected, and reporting may be inaccurate. |
20031 |
Job scheduler started |
Informational message. |
20032 |
Log file processor used more than %1$s% of total memory (%2$s MB) |
The log file processor's memory limit has been reached, and it exited. Although it is automatically restarted, action should be taken to increase the amount of the system's physical memory. |
20033 |
Content masking information not uploaded to Collector %1$s at %2$s. |
Warning message that configuration changes related to masking where not uploaded to the collector successfully. Suggested action is to make an additional masking change in order to force a new update to the collector. |
20034 |
Forms information not uploaded to Collector %1$s at %2$s. |
Warning message that configuration changes related to EBS Forms where not uploaded to the collector successfully. Suggested action is to make an additional EBS Forms change in order to force a new update to the collector. |
20035 |
Invalid event log file: %1$s |
A data file was found to be corrupt. One minute of data has been lost. |
20036 |
Content scan configuration not uploaded to Collector %1$s at %2$s |
Warning message that configuration changes related to content scanning where not uploaded to the collector successfully. Suggested action is to make an additional content scan change in order to force a new update to the collector. |
20037 |
Which headers to report not uploaded to Collector %1$s at %2$s |
Warning message that configuration changes related to HTTP headers capture where not uploaded to the collector successfully. Suggested action is to make an additional HTTP header capture change in order to force a new update to the collector. |
20038 |
Command exited with signal %1$s (%2$s) |
A system job exited with an error. |
20039 |
Connecting to database timed out after %1$s minutes |
A database connection could not be made, even after repeated attempts during the indicated period. |
20040 |
Data processing could not keep up with the amount of traffic measured |
Reported when not all the processing jobs could be completed within a 5-minute period. May indicate that the system is overloaded. Should be ignored if it occurs infrequently. |
20041 |
There have not been new log files in %1$s minutes |
Indicates that no Collector log files arrived at the Processing Engine. |
20044 |
Log file processing started |
Informational message. |
20045 |
Log file processing stopped with exit status %1$s |
There was an error that interrupted log file processing. It will be restarted automatically. |
20046 |
Core dump of log file processor |
Log file processor has crashed. It will be restarted automatically. |
20047 |
Log file processing stopped (missing parent process) |
The log file processing stopped because of an internal error. It will be restarted automatically. |
20048 |
Log file processor initialization failed |
Log file processing cannot start due to an internal error. It is strongly recommended that you contact Customer Support. |
20049 |
Log file processor reinitialization failed. Restarting |
Log file processing restarted due to an internal error. |
20050 |
Configuration update failed |
A configuration change could not be applied due to an internal error. |
20051 |
Command exited with exit status %1$s |
A system job failed. |
20052 |
Application matching information not uploaded to Collector %1$s at %2$s |
Configuration changes could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems. |
20053 |
Hit-type matching information not uploaded to Collector %1$s at %2$s |
Configuration changes could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems. |
20054 |
HTTP webdav enable information not uploaded to Collector %1$s at %2$s |
Configuration changes could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems. |
20055 |
HTTP proxy header information not uploaded to Collector %1$s at %2$s |
Configuration changes could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems. |
20056 |
Cannot connect to database; will retry |
Connection to the database failed. It will be re-attempted automatically. |
20057 |
Uploading of configuration to Collector %1$s at %2$s failed |
A configuration change could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems. |
20058 |
Uploading of configuration to Collector %1$s at %2$s timed out; retrying |
A configuration change could not be propagated to the Collector. It is recommended that you check the connect between the Reporter and Collector systems. |
20059 |
Connected to database after %1$s attempts |
Connection to the database previously failed, but has now succeeded. |
20060 |
Requested reboot for instance %1$s not necessary, config already up-to-date |
A previously scheduled Collector restart has been determined to be no longer necessary. |
20061 |
Failover: the primary Reporter is down; triggered failover to standby Reporter (host=%1$s) |
In a high-availability setup, the primary Reporter system failed and the failover Reporter system took over. |
20062 |
Failover: primary Reporter (host=%1$s): the standby Reporter seems to be down |
In a high-availability setup, the primary Reporter system detected that the failover Reporter system is no longer reachable. |
20063 |
More than %1$s cookies defined: ignoring cookie %2$s |
The limit on the number of configurable session cookies has been reached. It is recommended that you review your session tracking configuration settings. |
20064 |
Connected to database after some attempts |
Previous attempts to connect to the database failed, but connection has now succeeded. |
29006 |
Backup created |
A RUEI system configuration backup was created. |
29007 |
Backup restored |
A RUEI system backup was restored. |
29008 |
System reset to factory defaults |
The Reset to factory defaults option was selected from the System reset wizard. |
29009 |
Data purged |
The Purge collected data option was selected from the System reset wizard. |
29010 |
System processing restarted |
The Restart system processing option was selected from the System reset wizard. |
29011 |
Force a reconfiguration to solve the problem |
You need to select the Reapply latest configuration option from the System reset wizard. |
29012 |
Host %1$s: different time zone: %2$s instead of %3$s |
The indicated host was detected using a different time zone from that of the Reporter. All system hosts should use the same time zone. |
29013 |
Host %1$s: not time-synchronized, the difference is %2$s seconds |
This indicated host was detected as having too large a time difference with the Reporter. All system hosts should have approximately the same system time setting. |
29014 |
Host %1$s: failed to contact remote server to copy replay data to EPR |
The Collector could not be reached. As a result, some session replay data has been lost. |
29998 |
Internal error (%1$s) |
This message reports that a generic internal error occurred. |
29999 |
%1$s |
Generic informational message. |