Unrecognized characters in syslog payload not allowing alerts to be processed in RSA Security Operations Management
Originally Published: 2016-05-23
Article Number
Applies To
RSA Product/Service Type: SecOps
RSA Version/Condition: 1.3
Issue
Cause
<E2ETraceEvent xmlns="http://schemas.microsoft.com/2004/06/E2ETraceEvent"> <System xmlns="http://schemas.microsoft.com/2004/06/windows/eventlog/system"> <EventID>0</EventID> <Type>3</Type> <SubType Name="Error">0</SubType> <Level>2</Level> <TimeCreated SystemTime="2016-04-21T20:22:35.1718278Z" /> <Source Name="Archer.NET" /> <Correlation ActivityID="{00000000-0000-0000-0000-000000000000}" /> <Execution ProcessName="w3wp" ProcessID="3480" ThreadID="138" /> <AssemblyVersion>6.0.0.1470</AssemblyVersion> <Channel /> <Computer>XXXXXXXXX</Computer> </System> <ApplicationData> <TraceData> <DataItem> <TraceRecord Severity="Error" xmlns="http://schemas.microsoft.com/2004/10/E2ETraceEvent/TraceRecord"> <TraceIdentifier>Archer.NET</TraceIdentifier> <Description>Server was unable to read request.</Description> <AppDomain>/LM/W3SVC/1/ROOT-1-131057185801591970</AppDomain> <Exception> <ExceptionType>System.Web.Services.Protocols.SoapException, System.Web.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a</ExceptionType> <Message>Server was unable to read request.</Message> <Source>System.Web.Services</Source> <StackTrace> at System.Web.Services.Protocols.SoapServerProtocol.ReadParameters() at System.Web.Services.Protocols.WebServiceHandler.CoreProcessRequest()</StackTrace> <InnerException> <ExceptionType>System.InvalidOperationException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType> <Message>There is an error in XML document (1, 1237).</Message> <Source>System.Xml</Source> <StackTrace> at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String encodingStyle, XmlDeserializationEvents events) at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String encodingStyle) at System.Web.Services.Protocols.SoapServerProtocol.ReadParameters()</StackTrace> <InnerException> <ExceptionType>System.Xml.XmlException, System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType> <Message>'.', hexadecimal value 0x00, is an invalid character. Line 1, position 1237.</Message> <Source>System.Xml</Source> <StackTrace> at System.Xml.XmlTextReaderImpl.Throw(String res, String[] args) at System.Xml.XmlTextReaderImpl.ParseText(Int32& startPos, Int32& endPos, Int32& outOrChars) at System.Xml.XmlTextReaderImpl.ParseText() at System.Xml.XmlTextReaderImpl.ParseElementContent() at System.Web.Services.Protocols.SoapServerProtocol.SoapEnvelopeReader.Read() at System.Xml.XmlReader.ReadElementString() at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationReader1.Read19_CreateRecords() at Microsoft.Xml.Serialization.GeneratedAssembly.ArrayOfObjectSerializer36.Deserialize(XmlSerializationReader reader) at System.Xml.Serialization.XmlSerializer.Deserialize(XmlReader xmlReader, String encodingStyle, XmlDeserializationEvents events) </StackTrace> </InnerException> </InnerException> </Exception> </TraceRecord> </DataItem> </TraceData> </ApplicationData> </E2ETraceEvent>
Resolution
Workaround
Related Articles
SSL write error error:14095412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate 81Number of Views Creating an alert view 5Number of Views How to resize the Oracle database alert.log for RSA Identity Governance & Lifecycle 106Number of Views Connecting to database gives error: "sslv3 alert handshake failure" 86Number of Views Reducing the number of alerts from a view 17Number of Views
Trending Articles
RSA Announces the Release of RSA MFA Agent 2.5 for Microsoft Windows RSA MFA Agent 2.5 for Microsoft Windows Installation and Administration Guide RSA SecurID software token .sdtid file fails to import into RSA SecurID Software Token 5.0 for Windows How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device How to generate a PASSCODE for manual entry on a Ericsson R380 WAP phone
Don't see what you're looking for?