Timeout header added on email that did not experience a timeout during detection

Products

• Data Loss Prevention Network Prevent for Email

Issue/Introduction

You observe that the following timeout header is added to an email that did not not actually exceed any timeouts, but did not finish going through detection chain:

X-Symantec-DLP

Message timed out (potential Enforce system event 1213);

 

Along with the following warnings in the RequestProcessor logs:

com.vontu.mta.rp.handlers.DataProcessingState endTransfer
INFO: RPT(28): Error sending data to message chains. 
com.vontu.mta.rp.detection.DetectionException: java.net.SocketException: Connection reset
 at com.vontu.mta.rp.detection.RemoteDetectionRequestSubmitter.readResponseFromMessageChains(RemoteDetectionRequestSubmitter.java:182)
 at com.vontu.mta.rp.detection.RemoteDetectionRequestSubmitter.doDetection(RemoteDetectionRequestSubmitter.java:90)
 at com.vontu.mta.rp.handlers.DataProcessingState.endTransfer(DataProcessingState.java:426)
 at com.vontu.mta.rp.handlers.DataProcessingState.buffer(DataProcessingState.java:81)
 at com.vontu.mta.rp.RequestProcessorHandler.handleLineFromUpstream(RequestProcessorHandler.java:70)
 at com.vontu.mta.rp.connection.ConnectionsStateManager1G.handleLineFromUpstream(ConnectionsStateManager1G.java:137)
 at com.vontu.mta.rp.EventLoop.readPeer(EventLoop.java:275)
 at com.vontu.mta.rp.EventLoop.process(EventLoop.java:119)
 at com.vontu.mta.rp.ESMTPRequestProcessorThread.run(ESMTPRequestProcessorThread.java:105)
 at java.lang.Thread.run(Thread.java:748)

com.vontu.mta.rp.ResponseProcessor respond
WARNING: RPT(28) Passed message through due to timeout of message chains

Environment

Email Prevent 15.x

Cause

When certain timeout conditions occur, such as detection on a message component exceeding MessageChain.ComponentTimeout, FileReader is intentionally restarted:

com.vontu.messaging.chain.TimeoutHandler handleTimeout
WARNING: (DETECTION.12) Message chain #3 has exceeded the component timeout in Message Text Extractor. If it hasn't stopped processing in 30 more seconds this process will restart. Working on item RequestProcessor.2, total data length: 0

com.vontu.messaging.chain.TimeoutHandler handleExtendedTimeout
WARNING: (DETECTION.13) Intentionally restarting this process, as Message chain #3 is taking too long processing a message in Message Text Extractor. Working on item RequestProcessor.2, total data length: 0

Other emails that are in the RequestProcessor queue which are awaiting a detection resonse at the time FileReader is restarted will also be passed through to the downstream MTA with the timeout header:

com.vontu.mta.rp.ResponseProcessor respond
WARNING: RPT(28) Passed message through due to timeout of message chains

Resolution

This is working as designed.

Workarounds

• If you need to prevent emails that did not complete detection from being sent outside your network, configure your downstream MTA to quarantine emails that have the "message timed out" header added by DLP.
• Review MessageChain and ContentExtraction timeouts on your detection server to see if any of them should be increased, such as ComponentTimeout or MaximumMessageTime, etc.