Data Loss Prevention

 View Only
  • 1.  XML export of incidents with empty IncidentHistory

    Posted Sep 01, 2015 04:09 AM

    Hello all,

     

    As we export monthly report of all incidents in XML format,

    we see that we have ~20 first incidents with incidentHistory full of data,

    but other incident is empty of any information on that xml type.

     

    Do you have an idea ?

    Regards



  • 2.  RE: XML export of incidents with empty IncidentHistory
    Best Answer

    Posted Sep 01, 2015 04:52 AM

    Hello,

     

    I am used to export montlhy incidents in XML for data processing & analysis and never seen such issue. These incidents which have no data do not have any issue in DLP console as well? The only thing it comes to my mind is that due to some error at endpoint server or oracle DB, the incidents are not retriving all data (but in this case the incidents in console 'd be also without information - also known as "Yellow Screen of Death" by Symantec).

    Try to restart the servers and export it again.

     

    Cheers,



  • 3.  RE: XML export of incidents with empty IncidentHistory

    Posted Sep 02, 2015 03:48 AM

    thanks for your answer.

    Incident with no history has no problem on console view. We know YSOD because we faced this issue one month ago perhaps it's a side effect of that problem ?

    Today, as we tested XLM export, there is no problem so we think of a lack of memory ?



  • 4.  RE: XML export of incidents with empty IncidentHistory

    Posted Sep 02, 2015 04:18 AM

    I believe so. That's why I suggested to restart the servers/services.

    Other situation I noticed (actually was yesterday while doing monthly stats) is that downloading the XML file several times for the same number of incidents didn't have always the same filesize, so not all the content was being downloaded. Only at 3rd or 4th attempt got the correct number of incidents & content.



  • 5.  RE: XML export of incidents with empty IncidentHistory

    Trusted Advisor
    Posted Sep 02, 2015 06:15 AM

    Hello,

     It happens sometimes that for "any reason" (lack of memory, communication issue, processing delay) xml files are truncated.

     Take care that now most browser performs downloads in background and you should take care that download is really over before using the file (especially if you open them with an office tools which will lock the file).

     Usually i add a check in any tools using xml files to be sure everything is ok before processing some huge XML file.

     Regards.