DLP FileReader process stays in "starting" on Linux

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Network Monitor
• Data Loss Prevention Network Prevent for Email
• Data Loss Prevention for Mobile
• Data Loss Prevention Network Discover
• Data Loss Prevention Network Protect
• Data Loss Prevention Endpoint Discover

Issue/Introduction

On a Linux detection server, the DLP FileReader process will not start, but stays in a "starting" state indefinitely.

Environment

DLP Detection Server in Linux (RHEL) OS - usually after fresh install or upgrade

Resolution

• The FileReader process requires several Linux library prerequisites. If some of these are not met, the process will be unable to invoke all of the necessary components for it to start completely.

Review the list of required Linux RPMs in related article: What are the RPM requirements for Detection Server on Linux?

• To quickly check for this problem, try to invoke the content extractor (filter) manually from the command line.
  • Log into the system using the user whose credentials are used for the DLP services (default is 'protect'), and run the following command:

opt/Symantec/DataLossPrevention/KeyView/<version>/Protect/plugins/contentextraction/Verity/x86_64/filter

• If the command displays a list of options, then the libraries are installed correctly. If there is an error referring to a library file (commonly libstdc++.so.5), then some prerequisite library packages are not installed.
  • The most common missing packages are the compat-libstdc++-296 and compat-libstdc++-33 libraries.

 

NOTE: In some cases, filter is not executable by protect - in this case, another error will appear when trying to run the file.

• To correct this, login with root credentials and issue the following commands:

chown protect:protect opt/Symantec/DataLossPrevention/KeyView/<version>/Protect/plugins/contentextraction/Verity/x86_64/filter
chmod 750 /opt/Symantec/DataLossPrevention/KeyView/<version>/Protect/plugins/contentextraction/Verity/x86_64/filter