Debugging Detection Issues
search cancel

Debugging Detection Issues

book

Article ID: 159696

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent Data Loss Prevention Network Monitor Data Loss Prevention Network Prevent for Email

Issue/Introduction

Debugging Detection Issues

Environment

Data Loss Prevention

Resolution

Steps to take for debugging detection issues.

For DLP versions 16.0 RU2 and earlier:

Change the logging level on the following line in FileReaderLogging.properties:

  • com.vontu.detection.logging.DetectionExecutionTraceLogHandler.level=INFO, FINE, FINER, FINEST

For DLP version 16.1 and later:

Change the logging level on the following line in UDSDetectorLogging.properties:

  • com.symantec.dlp.clouddetectionserver.logging.UniversalDetectionExecutionTraceLogHandler.level=INFO, FINE, FINER, FINEST

To enable de-dupe logging:

  • com.vontu.policy.loader.execution.matrixmanipulators.DuplicateConditionManipulator.level = FINEST
  • java.util.logging.FileHandler.level = FINEST

 

 

Level 2: Are the right rules matching?  Set the logging level to Finer.  Use this level when a condition (or which condition) is generating matches (or not generating matches).

Enable the logging:

  • Add the following line to the FileReaderLogging.properties on the monitor in question:
    • com.vontu.detection.logging.BasicDetectionFeedback.level = FINER
  • Make sure that java.util.logging.FileHandler.level (near the beginning of the file) is set to FINER or FINEST
  • Safe the file
  • You do not need to restart the monitor, the changes will take effect right away

Level 3: Are all the rules matching on the right certain components?  Set the logging level to Finest. Use this level to see if a component is generating matches (or not generating matches).

Enable the logging:

  • Add the following line to the FileReaderLogging.properties on the monitor in question:
    • com.vontu.detection.logging.BasicDetectionFeedback.level = FINEST
  • Make sure that java.util.logging.FileHandler.level (near the beginning of the file) is set to FINEST
  • Save the file
  • You do not need to restart the monitor, the changes will take effect right away