Debugging Detection Issues

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Network Monitor
• Data Loss Prevention Network Prevent for Email

Issue/Introduction

Debugging Detection Issues

Environment

Data Loss Prevention

Resolution

Steps to take for debugging detection issues.

For DLP versions 16.0 RU2 and earlier:

Change the logging level on the following line in FileReaderLogging.properties:

• com.vontu.detection.logging.DetectionExecutionTraceLogHandler.level=INFO, FINE, FINER, FINEST

For DLP version 16.1 and later:

Change the logging level on the following line in UDSDetectorLogging.properties:

• com.symantec.dlp.clouddetectionserver.logging.UniversalDetectionExecutionTraceLogHandler.level=INFO, FINE, FINER, FINEST

To enable de-dupe logging:

• com.vontu.policy.loader.execution.matrixmanipulators.DuplicateConditionManipulator.level = FINEST
• java.util.logging.FileHandler.level = FINEST

 

 

Level 2: Are the right rules matching?  Set the logging level to Finer.  Use this level when a condition (or which condition) is generating matches (or not generating matches).

Enable the logging:

• Add the following line to the FileReaderLogging.properties on the monitor in question:
  • com.vontu.detection.logging.BasicDetectionFeedback.level = FINER
• Make sure that java.util.logging.FileHandler.level (near the beginning of the file) is set to FINER or FINEST
• Safe the file
• You do not need to restart the monitor, the changes will take effect right away

Level 3: Are all the rules matching on the right certain components?  Set the logging level to Finest. Use this level to see if a component is generating matches (or not generating matches).

Enable the logging:

• Add the following line to the FileReaderLogging.properties on the monitor in question:
  • com.vontu.detection.logging.BasicDetectionFeedback.level = FINEST
• Make sure that java.util.logging.FileHandler.level (near the beginning of the file) is set to FINEST
• Save the file
• You do not need to restart the monitor, the changes will take effect right away