SpanVA stopped sending log to CloudSOC after tokenization

Products

• CASB Audit
• CASB Gateway Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

After enabling tokenization on a SpanVA appliance (Settings > CloudSOC SpanVA > SpanVA Setup) there have been no logs uploaded to CloudSOC. Logs show that the SpanVA appliance is still processing files.  

Cause

There are two possible causes:

1. Tokenization utilizes an extensive amount of system resources. The system is too small and has created a bottleneck. 
2. The "test mode" for tokenizing data had been left checked.

Resolution

1. Ensure you increase your SpanVA system to a minimum of 4 cores with at least 16GB RAM to avoid processing bottlenecks. Estimate your current environment and any potential future growth.

1. 1. 1. Resizing the SpanVA disk allocation
      2. SpanVA System Requirements
         1. SpanVA *.151/153
         2. SpanVA *.160

2. Uncheck "test mode" in the SpanVA for tokenization. This will allow for the logs to upload to CloudSOC.