Symantec DLP writeback errors

Products

• Information Centric Analytics

Issue/Introduction

The following error is returned when performing Data In Motion (DIM) incident remediation in the Information Centric Analytics (ICA) Risk Fabric console:

_IncidentUpdate exception: Processing of the HTTP request resulted in an exception. Please see the HTTP response returned by the 'Response' property of this exception for details.

ICA's ActivityLog table and the RiskFabric web server logs record the following:

Execution Timeout Expired. The timeout period elapsed prior to completion of the operation or the server is not responding.

_IncidentUpdate exception: Processing of the HTTP request resulted in an exception. Please see the HTTP response returned by the 'Response' property of this exception for details.
DLPIncidentRemediation: Thread was being aborted.

The Symantec Data Loss Prevention (DLP) webservices_access log shows successful authentication attempts through the API.

Environment

Release : 6.5.x

Component : Symantec DLP Integration Pack

Cause

DLP incident remediation in an ICA installation with writeback enabled first initiates a lookup of the last action date and time in DLP to determine the databases' time difference. This is handled by the stored procedure spLDW_UpdateSymantecDLPTimeDifferenceForLinkedServer. In some large environments, the performance of this procedure's query is slow and eventually times-out, causing the writeback call to fail.

Resolution

An enhancement to handle this condition was introduced in version 6.6.