Event parser service starts but get stuck on ePo 5.10

[dadialla]

Hello, sorry for the delay in my response.

Right now the error that we can see in the eventparse log is: 

E #20136 HOSTDLPEVENT Unable to find user info in event. Dump: MachineName=<DLP_HOST_MACHINENAME>. AgentGUID={XXXXX-XXX-XXX.....}. IpAddress=X.X.X.X. OsName=Windows Server 2012. RawMACAddress=XXXXXXX. UserName=SYSTEM. PolicyName=. GMTTime=2020-02-10 05:27:00. TimeZoneBias=-60. EpoGlobalEventID=19170

Right now we're running a schedule task in the server to restart the eventparser log every 5 minutes in order we can receive the DLP logs

Thank you

[LKS]

Hi dadialla,

There might be something else recorded in the log file. I would say you can open a SR with DLP team to get it fixed. You may have to enable Log level 8 on the EPO server to see what exactly happens when DLP events trying to parse to DB.