The File Reader for Data Loss Prevention (DLP) restarts excessively.
File Reader restarts usually occur due to timeout issues, which can be caused by the following:
If the File Reader restarts itself occasionally, this is normal behavior. However, if you are experiencing consistent File Reader restarts in your environment, there are a few things you can do to determine the cause:
Review File Reader logs to identify which File Reader subsystem isn’t starting.
Once identified that a particular subsystem isn’t receiving its configuration, review the MonitorController log to see if the corresponding subsystem has been initialized successfully.
One of the common failures is an inability to ignite cryptographic keys in the MonitorController because the ignition password on the disk got out of sync with the Administrator password in the database. In this case, the password issue must be fixed, and only after that should the MonitorController be restarted.
...Program Files\Symantec\DataLossPrevention\DetectionServer\Services\SymantecDLPDetectionServer.conf
# Initial Java Heap Size (in MB)
wrapper.java.initmemory = 1024
# Maximum Java Heap Size (in MB)
wrapper.java.maxmemory = 2048
FileReader restarts can occur due to a particular policy. An example is a regex in a particular policy exceeds given thresholds (such as maximum component time).
Each new exception, while improving the ability to "short-circuit" detection, can multiply the size of the overall execution (detection) matrix - all of which is loaded into memory when File Reader starts.
While there is no exact limit on the total number of exception, a good rule of thumb is limit exception line count, leverage lists (Sender/Recipient) and avoid compound rules.
See High memory usage of DLP agent caused by compound exceptions.
Confirm that the MessageChain.CacheSize and MessageChain.NumChains match the number of CPU cores on the server.
For steps to edit these settings refer to the Advanced server settings help page.
Note: Although Content Extractor can have problems processing various file formats, it will rarely cause File Reader restart.
Dying threads can cause File Reader to stop reporting heartbeats and eventually be restarted.
Review Look in BoxMonitor.log for exceptions. Each exception in that log file is an indicator of a serious problem (Java crash or another defect) and is a likely cause of a File Reader restart.
If none of the above resolves your File Reader restart issues, contact Broadcom Support for further troubleshooting.