Events are not being mapped to incidents over EM web-interface.
Enable debug for event loader process for the troubleshooting and analysis of any error within DLP Datacenter environment or to verify that there isn't in-correct configuration for the used repository/grid-scan group or agent-scan group.
Below is an example of miss-configuration that has been discovered when viewing eventloader.log file after enabling a DEBUG on it (steps are explained in next section):
23 Sep 2015 13:21:00,078 | ERROR - DiscoveryEventMapper.isGroupedByOwner(875) | A grid scan group is used for an agent scan!!!
23 Sep 2015 13:21:00,078 | ERROR - DiscoveryEventMapper.mapAgentDiscoveryEvents(292) | FunctionalFlow - EventLoader_EventIncidentMapping: Unexpected error in mapping agent events: A grid scan group is used for an agent scan!!!
com.tablus.tem.service.impl.MappingException: A grid scan group is used for an agent scan!!!
On your RSA DLP Enterprise Manager server please do the below prior running a Datacenter scan:
1. Go to the path: C:\Program Files(x86)\RSA\Enterprise Manager\webapps\root\WEB-INF\classes
2. Open log4j.xml file with a notepad or wordpad to edit it:
change level value for "com.rsa.xx" from it's existing value [INFO/WARN] to DEBUG
3. Open eventloaderlog4j.xml file with a notepad or wordpad to edit it:
change level value for "com.tablus" from it's existing value [ERROR] to DEBUG
4. Launch a Datacenter scan and upon the successful completion of the scan, you can view & start analyzing both "em.log" & "eventloader.log" files which are located under the path:-