Skip to main content

Join us at Gartner SEC London and discover how LevelBlue can help you secure what’s next. Learn More

Loading...
Loading...

ERRMSG: AD Agent OverflowException

Expand / Collapse


This article applies to:

  • R3000 Enterprise Filter / AD Agent 1.0.3

Symptoms:

The AD Agent sends alert emails with the following type of exception caught:
System.OverflowException: Value was either too large or too small for a UInt16.
   at System.Threading.ReaderWriterLock.AcquireReaderLockInternal(Int32millisecondsTimeout)
   at System.Threading.ReaderWriterLock.AcquireReaderLock(Int32millisecondsTimeout)
   at LibDcAgent.DomainList.NormalizeDomainName(String name)
   at NetScan.WorkstationProbe.pulseDrainResultQueue(Object appRef,Int32 delta)
   at LibDcAgent.Pulse.Drive()
   at NetScan.NetScan_main.Main_imp()
   at NetScan.NetScan_main.Main(String[] args)

Causes:

  • The Agent is trying to parse an event that is too long for the buffer it uses for parsing

Resolution:

This error is not anything to be concerned about - it is simply the Agent saying that a line in your AD security logs (or probe results) was too long for it to parse.  Since the Agent will only respond to logon/logoff events, which are not too long to parse, it would not have done anything with these lines even if it could parse them.


To contact LevelBlue about this article or to request support:


Rate this Article:
     

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.