DLP Write-back Failure

book

Article ID: 191832

calendar_today

Updated On:

Products

Information Centric Analytics

Issue/Introduction

Remediation write-back jobs to DLP do not complete. The 'DateProcessed' value for these jobs in the DIMRemediationSets table is NULL, as is the 'StatusProcessed' value.

Cause

The LinkedServerIDs to which DLP write-back jobs are directed no longer exist.

Environment

Release : 6.5.3

Component :

Resolution

Remove references to orphaned LinkedServerIDs via the built-in stored procedure spDBA_PurgeSymantecDLP:

EXEC spDBA_PurgeSymantecDLP @i_nLinkedServerID = <orphaned_linked_server_id>

Additional Information

The following query will return a list of DIM Remediation Set IDs and the state of the LinkedServers to which they're directed:

SELECT rsets.DIMRemediationSetID,
  i.LinkedServerID,
  CASE WHEN ls.LinkedServerID IS NULL THEN 'Broken' ELSE 'Okay' END AS LinkedServerState
FROM (
 SELECT 
  rs.DIMRemediationSetID,
  MAX(rsi.DIMIncidentID) as maxDIMIncidentID
 FROM 
  DIMRemediationSets rs
  JOIN DIMRemediationSetIncidents rsi ON rs.DIMRemediationSetID = rsi.DIMRemediationSetID
 WHERE  
  rs.DateSubmitted IS NOT null
  AND rs.DateProcessed IS null
 GROUP BY 
  rs.DIMRemediationSetID
) rsets
JOIN LDW_DIMIncidents i ON i.DIMIncidentID = rsets.maxDIMIncidentID
LEFT JOIN LinkedServers ls ON ls.LinkedServerID = i.LinkedServerID