Data Loss Prevention

We currently have 6 endpoint policies that use regular expressions to identify sensitive data.  To refine the policies we have been mostly using exceptions to make sure we are capturing the correct data.  After adding the most recent exception (regex to ignore facebook userIDs) the Endpoint servers crashed and gave out of memory errors.  After removing the exception all was normal.  To experiment I removed a different exception and re-added the facebook exception and everything worked perfectly.  I appear to have reached the limit to the number of exceptions a policy can have.  Has anyone heard of this?  Is there a setting on the Endpoint servers we can change to allow more exceptions?

Thanks,

Jeremy

Not to my knowledge is there a setting change that can be made. If there is, you probably should call Symantec as it may require changes to a conf file.

What if you increase RAM on the servers?

We have two different configurations (5 endpoint servers) and the problem occurs on the machines with 8GB and 16GB of ram.

is this a physical or virtual server? take a look in the server logs and see what is goin on.

Also take a look at the enforce server and make sure nothing is going on on there like other services quitting. I have seen it only once before in a vmware enviroment... just suggestions i would have to see more. also opend a cae with symc support i wuld be interested in the outcome you can send them the logs from the servers.