DLP Write-back Failure

Products

• Information Centric Analytics
• Data Loss Prevention Core Package

Issue/Introduction

Remediation write-back jobs to DLP do not complete. The 'DateProcessed' value for these jobs in the DIMRemediationSets table is NULL, as is the 'StatusProcessed' value.

Environment

Release : 6.5.3

Component :

Cause

The LinkedServerIDs to which DLP write-back jobs are directed no longer exist.

Resolution

Remove references to orphaned LinkedServerIDs via the built-in stored procedure spDBA_PurgeSymantecDLP:

EXEC spDBA_PurgeSymantecDLP @i_nLinkedServerID = <orphaned_linked_server_id>

Additional Information

The following query will return a list of DIM Remediation Set IDs and the state of the LinkedServers to which they're directed:

SELECT rsets.DIMRemediationSetID,
  i.LinkedServerID,
  CASE WHEN ls.LinkedServerID IS NULL THEN 'Broken' ELSE 'Okay' END AS LinkedServerState
FROM (
 SELECT 
  rs.DIMRemediationSetID,
  MAX(rsi.DIMIncidentID) as maxDIMIncidentID
 FROM 
  DIMRemediationSets rs
  JOIN DIMRemediationSetIncidents rsi ON rs.DIMRemediationSetID = rsi.DIMRemediationSetID
 WHERE  
  rs.DateSubmitted IS NOT null
  AND rs.DateProcessed IS null
 GROUP BY 
  rs.DIMRemediationSetID
) rsets
JOIN LDW_DIMIncidents i ON i.DIMIncidentID = rsets.maxDIMIncidentID
LEFT JOIN LinkedServers ls ON ls.LinkedServerID = i.LinkedServerID