Diagnosing IE Monitoring on the Endpoint

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Discover

Issue/Introduction

How to diagnose Endpoint IE Issues

Resolution

Diagnosing Internet Explorer (IE) Monitoring

IE Monitoring not working, content/files can be uploaded using Internet Explorer

Verify the following:

1. Endpoint agent is running, and hmc.dll is loaded in the process; for this process explorer can be used.
2. Check if IE (HTTPS) monitoring functionality is enabled on the Enforce.
3. Check if iexpm.dll is injected in the Internet Explorer instance; process explorer can be used to verify this.
4. Collect the endpoint agent log by setting the IEMonitorLevel to FINEST. For instructions on accessing the cg.ead database: See TECH219080. 
5. INSERT or REPLACE into configuration values ('Logging','IEMonitorLevel','str','FINEST');

Application Crash or Hang

1. Check if the crash\hang is reproducible without the Endpoint Agent.  In most of the cases the applications themselves might crash.
2. Turn off the IE (HTTPS) monitoring feature, and observe if the hang\crash is reproducible.  This would ensure if the crash\hang is related to IE (HTTPS) monitoring feature.
3. Get the dump of the application.  One can use Windbg or Dr. Watson for generating the dump.