Event code 1213 "Messages timed out in detection"

Products

• Data Loss Prevention Cloud Prevent for Microsoft Office 365
• Data Loss Prevention Network Monitor
• Data Loss Prevention Network Prevent for Email
• Data Loss Prevention Enforce
• Data Loss Prevention Network Monitor and Prevent for Web

Issue/Introduction

Event code 1213 (" x# of Messages timed out in detection")  is appearing in the Enforce console System Events.

File Reader logs on the detection server may show:

INFO: Detection timed out on message [xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx]

Where x = an alphanumeric character

Cause

Event Code 1213 was introduced in DLP 12.5.0.

The actions occured prior to this version, but no event was logged.

The message will be delivered unless detection had sufficient time to wholly determine a block rule was necessary, this will only occur if no further exclusions could have been detected had the message not timed out, that would have prevented the block from taking place.

 

 

 

Resolution

In 14.6 MP1 the ability to add a modified header in messages that timed out in detection.  This is specific to Network Prevent for Email.  This can be turned on or off in the advanced server settings by modifying the 'RequestProcessor.AddHeaderOnMessageTimeout' value.  The default value is false. Enabling this will add a descriptive header message that will allow E-mail administrators to change how the message is handled down stream. See the DLP 15.0 Administrator Guide for further details