Data Loss Prevention

recently i have the ceh.exe service keep hanging or crashing . caused email struck in the gateway and force to bypass dlp prevent server .

Please advise.

ceh.exe is the content extractor host process which hosts the c++ libraries for Vontu.  I had a similiar problem on another detection server after an upgrade and a clean install.  Basically the only fix for that was to open a case with Symantec and get a hotfix applied. 

Hi demo,

above things may be right but you can check below scenrio.

Above problem may be coming due to encrypted data is going out or corrupted packet/data cant be extracted and continously trying and going into loop.There may be some email prevnt service cordination

Regards

Kishorilal

Hi demo,

I am not aware of CEH.exe , i have tried to get details on this on net but could not found anything. Could you please provide me more details on this? then i wil try to resolve the same.

Thanks

Symantec recommended to apply a EEB on the DLP11.0.

Brief summary of issue details and resolution provided:

ISSUE : DLP Prevent for Email has high CPU utilization. (CEH.exe uses 99% CPU).

SOLUTON: Followed KB articles 55185 and 54169 and reset following  values and Java heap space settings.

MessageChain.MaximumComponentTime = 1400000

ContentExtraction.RunawayTimeout = 1300000

ContentExtraction.LongTimeout = 160000

KB articles which are useful: 

Article ID: 55185 --  In an overloaded environment, detection process is timing out
https://kb1-vontu.altiris.com/article.asp?article=55185&p=5
Article ID: 54169 -- Filereader restarts with error "java.lang.OutOfMemoryError: Java heap space" during discover scan
https://kb1-vontu.altiris.com/article.asp?article=54169&p=5