Data Loss Prevention

Please suggest any solution , As I can see continously endpoint service is in running mode and not green and stable.When I gone through event error message as below

Message  
Code  1007  
Summary  FileReader restarts excessively  
Detail  Process FileReader has restarted 4 times during last 51 minutes.  
 

In my experience, Filereader can crash with specific policy rules. Try the below:

1. Disable all policies and check the status of filereader.
2. If 1 helps, enable the policies one by one. This will help you pinpoint the concerned policy.
3. Check the policy rules

• EDM/IDM only rules may be taking a toll on Endpoints. It is not recommended to leverage EDM/IDM on Endpoints. Moreover, you cannot block with EDM/IDM on Endpoints.
• Check for any specific regex rules, if any.

4. Check the Filereader log. In many cases filereader restarts with JVM errors. Tweaking the Java heap size in the Filereader config file may help.

denish,

I  have disabled all policies but still problem persist. Its working but that services on enforce shows as starting.

• What is the version of DLP? Filereader related issues were significantly reduced with DLP 11.6. Hence, you may want to recommend upgrading in case they are already on 11.x.


• Do we see any JVM or other errors in the Filereader or Manager log file?

You may also try the below:

1. Backup all the configuration files on the concerned detection server.
2. Uninstall and reinstall the DLP binaries from the detection server. Validate the service status on the local server.
3. Restore the configuration files. Validate the service status again.

If the issue persists, it could be an issue with some configuration file parameters. Hope this helps?

Cheers,

Denis

Hi,

after disabling all policies try to restart Vontu Manager & Vontu Monitor Controller (Enforce) and Vontu Monitor (Endpoint server). Than you can enable all again.

Regards.