Error: "2115 - Custom attribute lookup failed" in DLP Detector Detail

Products

• Data Loss Prevention

Issue/Introduction

Symantec Data Loss Prevention (DLP)
Custom attributes

You see an intermittent error code "2115 Custom attribute lookup failed" in System > Servers and Detectors > Overview > Server / Detector Detail.

The IncidentPersister log has these entries:

Level: WARNING
Source: com.vontu.lookup.script.ExecCommand.execute
Message: Process exit value indicates error in execution.  Exit value: 1 for command: /usr/bin/python

Level: SEVERE
Source: com.vontu.lookup.script.ExecLauncher.launch
Message: Failed to execute script.
com.vontu.lookup.script.ScriptLookupException: []Traceback (most recent call last):  File "/opt/Symantec/DataLossPrevention/EnforceServer/15.8.00000/Protect/plugins/scripts/icap-parse.py", line 9, in <module>    userbad, domain = value.split('@',1)ValueError: need more than 1 value to unpack

Level: SEVERE
Source: com.vontu.enforce.workflow.attributes.DeferredUpdateLookupRequest.doLookup
Message: Script Lookup Processing Error
com.vontu.api.incident.attributes.AttributeLookupException: Script Lookup Processing Error
...Caused by: com.vontu.lookup.script.ScriptLookupException: Failed to execute script.
...Caused by: com.vontu.lookup.script.ScriptLookupException: []Traceback (most recent call last):  File "/opt/Symantec/DataLossPrevention/EnforceServer/15.8.00000/Protect/plugins/scripts/icap-parse.py", line 9, in <module>    userbad, domain = value.split('@',1)ValueError: need more than 1 value to unpack

The custom attribute does work and populates the incident with the expected information.
Other than the error in the console and log there is no operational impact on the DLP system.

 

 

Environment

Release: 15.8

Component: Custom attributes

Cause

The custom attribute occasionally returns a special character that causes this error.

There is no operational impact on the DLP system.

Resolution

If possible, modify the custom attribute to not return special characters.

This is fixed in DLP 16.0.