The file <filePath> was in the ignore file list. Will not send a detection request for this file. Detection response from ignore list: 2

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

You see the following FINER log entry in the agent ext logs and want to understand its meaning:

FINER | Source: FileSystem.MessageListener The file <filePath> was in the ignore file list. Will not send a detection request for this file. Detection response from ignore list: 2

Resolution

This message is logged by the MessageListener class within the FileSystemConnector component (fsc.dll). It is logged when the agent receives a data in motion request for a file that is already in flight within the detection chain.

This happens when two or more channels/monitors advise the agent of a DIM event. For example, if the Advanced Agent Setting - Hooking.EXPLORER_HOOKING.int - is set to 1, and you drag and drop a file onto a destination within Windows Explorer, the File Operations Manager component (fom(64).dll) that is hooked into explorer.exe will initiate a DIM request. At the outset of this request, the file path and process id are added to a small cache "FileDetectionIgnoreCache" with an EScanResult of 2 "ALLOW". Once the detection request completes, this entry is removed from the ignore list/cache.

Concurrently with the FOM based request from the drag/drop scenario described above, when the file copy closes, the DLP file system mini filter driver (vfsmfd.sys) will send another DIM request through FSC. To prevent multiple concurrent detections on the same file, the ignore list is checked, and if the file is found to still be in flight within detection, it is removed from the ignore list, and the following FINER level message is logged: "The file <filePath> was in the ignore file list. Will not send a detection request for this file. Detection response from ignore list: 2".

A key takeaway is that this message is not indicative of a detection miss.