Data Loss Prevention

Hello,

The issue I'm seeing is that the System > Agent Overview page isn't updating the status of the agents.  I'm still getting the events from the agents but I'm not getting their current status.  I have already tried restarting the VontuMonitorController service and that seemed to work for at least a day.  Since this is a PROD system I haven't had a chance to reboot yet, however I don't think I should have to reboot this box once a day or a few times a week for it to work properly.

Has anyone else seen this issue before and have ideas on how to fix?

zach,

take a look and see if all services are running forst. also take a look and see if there are planty of resources running on the box. I had a issue every once in a while with this, was it built on min specs or suggested?

whats the DLP version?

run netsta command to see if the clients are communicating with the server 

I'm getting events from devices showing offline or not in the console at all.

The Enforce server has a dual-quad core 2.66ghz instead of a 3.0ghz.  It also has 12gig of RAM.  All of the Vontu services are running the the /Protect/bin/ directory.

can you post the event data or screenshot?

What exactly do you mean?

the events you referring to.

The events (incidents) are coming through just fine, there are hundreds of them.  The issue is the Agent Overview not updating correctly.

Zach,

Is the endpoint server on a different box or the same one as the enforce server?

If it is on the same box, you will have a resource issue especially if you are running ORacle on the same server.

If it is on a different box, then recyle the services on that server.

Also what are the specs of the endpoint server.

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

Hello,

Our Endpoint servers are separate VMs, I'm running in the 12.0 environment.  I have already tried restarting their services manually, cycling the services from the Enforce, rebooting, reinstalling the DLP software.  The only thing that seemed to help (for a day) was restarting the MonitorController service on the Enforce server itself.

Zach,

I think the issue might be with the Linux OS. Make sure to turn off IPTABLES.. this will cause an issue with opening ports.Also make sure to turn off any other OS security.

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

When I turned IPTABLES off it also took down our Enforce web gui.

Please restart the endpoint server and chcek whether it reflecting the status.

Zach,

What maker and version is the Linux OS?

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

RHEL 5.8 if that's what you mean.

UPDATE: So it appears we were having database issues. We have had those resolved and rebooted the Enforce server.  I'm hoping that this was the cause of the Agent Overview issue as well, but time will tell.