Check to see if your EDM profile was pushed to the Detection Server

Products

• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

Instructions for how to check for to see if there were issues with pushing your EDM profile to the Detection Servers.

Behavior: Detection Trace Logs may show that the EDM (DATABASEPROFILE) was not executed, but all other rules executed successfully.

  - Condition: <EDM Name> (DATABASEPROFILE,ID=######)   <not executed>

Environment

15.x, 16.x

Cause

This can occur if there is a problem with the index, in many cases simply re-indexing the EDM may resolve the issue.

Resolution

Start by restarting the Detection Server Service on the Detection Server.

Now Lets check the System > Servers and Detectors > Overview > [Detector Details]. Here you should see a section showing all recent events, specifically we want to make sure the policies and EDM profiles are showing loaded. If you select the option to "show all" events, it will give you a full list of all events that have occurred...

Here we see 3 key entries...
- Detection Server Stopped: This shows us where the service was restarted, during the service startup
- Loaded Database Profile: This shows us that a profile was successfully loaded.
- Failed to Load Database Profile: This shows us that there was a failure to load a profile.

If you see a "Failed to Load Database Profile" event, you can simply click on the link to get more details...

This will open a new page with additional details about the actual error message...

In this case we see a failure to load the RAM index which can generally be resolved by simply re-indexing the EDM. Here we can also see the following EDM information presented...
EDM Name: "EDM - DLPTest Data"
EDM Version: 8
Index Location: C:\ProgramData\Symantec\DataLossPrevention\DetectionServer\15.8.00000\..\..\ServerPlatformCommon\15.8.00000\index
Index Files: DataSource.1.22.8.rdx.<filecount>
- DataSource.1.<IndexID>.<IndexVersion>.rdx.<filecount>
- So this also tells us that the IndexID in this case is '22'
IndexID: 22

Now to confirm if the Server actually received the index or not, log into the Detection Server and check the following location...
C:\ProgramData\Symantec\DataLossPrevention\ServerPlatformCommon\15.8.00000\index

Here we want to check for the IndexID and the IndexVersion. So in this case we're looking for file like the above that use "DataSource.1.22.8.rdx.#", any similar file would be the appropriate index. If these files exist on the Enforce Server, but do not exist on the Detection Server, then it is failing to push the indexes to the Detection Server.

Common Causes:
- Invalid Index, re-indexing or re-creating index may resolve the issue
- SymantecDLPDetectionServerController Service does not have enough available memory. You should see signs of this in the service log.