Symantec DLP writeback errors

Products

• Information Centric Analytics

Issue/Introduction

The following error is returned when performing incident remediation in Information Centric Analytics (ICA):

_IncidentUpdate exception: Processing of the HTTP request resulted in an exception. Please see the HTTP response returned by the 'Response' property of this exception for details.

The ICA ActivityLog table and RiskFabric web server logs show the following:

Execution Timeout Expired. The timeout period elapsed prior to completion of the operation or the server is not responding.

_IncidentUpdate exception: Processing of the HTTP request resulted in an exception. Please see the HTTP response returned by the 'Response' property of this exception for details.
DLPIncidentRemediation: Thread was being aborted.

The Symantec DLP webservices_access and webservices_soap logs show successful authentication attempts via the API.

Environment

Release : 6.5.x

Component : Symantec DLP Integration

Cause

DLP incident remediation in an ICA installation with writeback enabled first initiates a lookup of the last action date and time in DLP to determine the databases' time difference. This is handled by the stored procedure spLDW_UpdateSymantecDLPTimeDifferenceForLinkedServer. In certain large environments, the performance of this procedure's query is slow and eventually times-out, causing the writeback call to fail.

Resolution

An enhancement to handle this condition was introduced in version 6.6.