Data Loss Prevention

 View Only
  • 1.  JDBC Logging

    Posted May 04, 2015 04:58 AM

    I am experiencing more and more issues of users reporting they are not able to open incidents anymore.
    It's always the same behaviour: User clicks on an incident and gets the following error message:

    An unexpected error has occurred. This could be due to one of the following: 1) Your session timed out and you selected a link that was no longer valid, 2) You used the browser back or forward button placing the system into an inconsistent state, or 3) The system experienced a temporary problem.

    No incident data is displayed at all, just the red bar.
    It seems like the manager is not able to get the conditions of numerous incidents. After checking the logfiles, I found an entry for each attempt to open such an incident.
    As an example:

    30 Apr 2015 17:18:41,820- Thread: 23 WARNING [com.vontu.manager.report.snapshot.IncidentDetailPage] (MANAGER.200) Error generating match highlighting for incident 2'244'070, incident detail will be rendered without them
    Cause:
    com.vontu.manager.report.snapshot.matches.MatchHighlightingException: Error marking violating content for incident 2244070
    java.lang.IllegalArgumentException: Condition ID 2762 not present in policy [%POLICYNAME%

    I want to know what is going on and if I am able to fix this in one way or another.

    To do so, the thing I thought about was logging the JDBC and therefore SQL traffic between the DLP server and the database. I have tried to implement the log4jdbc module, but it's not really working properly.
    Just a few minutes ago, I discovered the potential built-in method to log JDBC in this forum topic (SystemDiagnostics.Do):
    http://www.symantec.com/connect/forums/incident-queue-backlogged-alert-1814

    Thing is, in 12.5.2 this does not seem to be available.
    Is there any other way to log JDBC communications of DLP in version 12.5.2?

     



  • 2.  RE: JDBC Logging

    Broadcom Employee
    Posted May 04, 2015 05:58 AM

    is the policy still available on detection server for which the incidents are generated?

     



  • 3.  RE: JDBC Logging

    Posted May 04, 2015 07:06 AM

    Oh yes, absolutely. It has been active since day 1.



  • 4.  RE: JDBC Logging

    Posted May 05, 2015 09:28 AM

    Alright, I managed to get the logging up and running. Nothing interesting from this side to resolve the issue or shed some light onto this.



  • 5.  RE: JDBC Logging

    Trusted Advisor
    Posted May 06, 2015 03:27 AM

    hello,

     is this happening always for same policy or for every policies ? Did you install 12.5.2 from scratch or was it done by upgrading previous version ?

    If it happens only for one, you can try to check in DB which is condition with ID 2762, in order to try to recreate it in your policy and try to save it again to clean information in DB which may have been correupted for any reason.

     

     Regards



  • 6.  RE: JDBC Logging
    Best Answer

    Posted May 20, 2015 04:08 PM

    This is actually solved by now. The archived policies had corrupted information in their XML definitions.