ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

DLP 15.1 Network Monitor Packet Capture Fails to Start

book

Article ID: 172627

calendar_today

Updated On:

Products

Data Loss Prevention Network Monitor

Issue/Introduction

You notice packet capture fails to start automatically on your DLP Network Monitor.  You try to start packet capture manually and it still fails to start.  You notice in the DLP UI message code 1008 process went down before it had fully started.

When trying to start packetcapture manually you see the following error, 

PacketCapture: error while loading shared libraries: libPacketCapture.so: cannot open shared object file: No such file or directory. 

Cause

Packetcapture needs to run as root.  But, your server has been hardened and doesn't permit sudo command by DLP application.  

Environment

BoxMonitor log 
 
Class: om.vontu.logging.LocalLogWriter
Method: write
Level: SEVERE
Message:  PacketCapture is down. PacketCapture process went down before it had fully started.
SymantecDLPDetectionServer log
 
Level: INFO
Source:  jvm 1   
Message:  PC> sudo: no tty present and no askpass program specified
 
Which is the usual message received when attempting to run a sudo command but don’t have permissions.

Resolution

You must edit /etc/sudoers file and add #includedir /etc/sudoers.d to the sudoers file.

Also, make sure you have the following entry in the /etc/sudoers.d, as this is automatically inserted during DLP 15.1 Network Monitor Server install,

# Vontu service user
Defaults:SymantecDLP !requiretty
SymantecDLP ALL= NOPASSWD: /bin/mount, /bin/umount, /usr/bin/sshfs
SymantecDLP ALL= NOPASSWD: /lib64/ld-linux-x86-64.so.2 --library-path /opt/Symantec/DataLossPrevention/Detection Server/15.1/Protect/lib/native\:/opt/Symantec/DataLossPrevention/Server JRE/1.8.0_162/lib/amd64/server /opt/Symantec/DataLossPrevention/Detection Server/15.1/Protect/bin/PacketCapture *