AD Agent OverflowException


This article applies to:

  • R3000 Enterprise Filter / AD Agent 1.0.3

Symptoms:

The AD Agent sends alert emails with the following type of exception caught:
System.OverflowException: Value was either too large or too small for a UInt16.
   at System.Threading.ReaderWriterLock.AcquireReaderLockInternal(Int32millisecondsTimeout)
   at System.Threading.ReaderWriterLock.AcquireReaderLock(Int32millisecondsTimeout)
   at LibDcAgent.DomainList.NormalizeDomainName(String name)
   at NetScan.WorkstationProbe.pulseDrainResultQueue(Object appRef,Int32 delta)
   at LibDcAgent.Pulse.Drive()
   at NetScan.NetScan_main.Main_imp()
   at NetScan.NetScan_main.Main(String[] args)

Causes:

  • The Agent is trying to parse an event that is too long for the buffer it uses for parsing

Resolution:

This error is not anything to be concerned about - it is simply the Agent saying that a line in your AD security logs (or probe results) was too long for it to parse.  Since the Agent will only respond to logon/logoff events, which are not too long to parse, it would not have done anything with these lines even if it could parse them.


Last Modified 6/4/2009.
https://support.trustwave.com/kb/KnowledgebaseArticle12774.aspx