Data Loss Prevention

The Symantec DLP Discover server shows "unknown" as status. It says "low disk space" as error event. I increased the disc size to 60 GB now but still it shows same error. Also, the error date is 2 days ago and there's no update in the status. No new error as well.

We have restarted the VM, the host and the service (in the sequence recommended by Symantec). No results so far. Is there a way we can make the discover server run? Are we missing out on something?

Any help will be greatly appreciated!

Thanks,

Soumya

hello

Do you have other detection server which are up and running ?

 usually unknown status means "MonitorController" windows services is down.

Connect to your discover server and try to restart vontu services.

regards

Hi Stephane,

Thanks for your response.

The VM on which I am running the discover has enforce server running. Another discover server is running in a different server.which is controlled from this interface. Even that one has stopped working siting "filereader is down". You're right, we do find that MonitorController service has stopped. However, restarting the service does not help. We then tried restarting all services in sequence, didn't help either.

Moreover, the event with status "severe" is dated from 2 days ago, making me concerned whether it is at all probing for the new space that I have created by deleting other files.

Much appreciate your support and looking forward to hearing back.

Thanks,

Soumya

event are generated once and so never deleted or acknowledged.

you may restart all services on enforce server (or reboot windows if it simpler for you to do so).

You could also check if nothing has changed on server (IP addres / fqdn) and connection still possible by trying to ping detection server from enforce or try to connect on port 8100.

The point I wanted to make about the event was, no new event is generated which may give us an understanding of why won't the server run.

Also, we've tried restarting all the services, the server (VM) and the host box as well. 8100 port is down as netstat does not show 8100 (may be because the server is not running - as can be seen in the server overview window)

You may want to also check to see if ANY drive is full, it may not just be the install drive. Also look at the DB and see if there is any space issues there, possibly the Tablespace.

Lastly - Reboot the machine. You may have not started up the services properly.

Open up the logs on the VontuMonitor it may tell you a lot more than what shows in the console.