DLP detection server fails to start after an upgrade to a Maintenance Pack version

Products

Data Loss Prevention Data Loss Prevention Discover Suite Data Loss Prevention Endpoint Suite Data Loss Prevention Enterprise Suite

Issue/Introduction

After an upgrade of a DLP detection server to a Maintenance Pack (MP) version, you see that the server is unable to start. Restarting the server doesn't help.

Cause

In the FileReader log, you can see the following entries which say that the service was unable to start:

Oct 13, 2021 11:32:42 AM com.vontu.messaging.FileReaderSetup initialize
SEVERE: (DETECTION.3) Failed to initialize Detection
java.lang.ExceptionInInitializerError
 at com.vontu.discover.remediation.detection.DiscoverServerRemediationDetectionConfiguration.getCatalogEntryService(DiscoverServerRemediationDetectionConfiguration.java:111)
 at com.vontu.discover.remediation.detection.DiscoverServerRemediationDetectionSubsystem.<init>(DiscoverServerRemediationDetectionSubsystem.java:52)
 at com.vontu.discover.InductorContext.initializeRemediationManager(InductorContext.java:238)
 at com.vontu.discover.InductorContext.initialize(InductorContext.java:103)
 at com.vontu.discover.InductorContext.initialize(InductorContext.java:86)
 at com.vontu.discover.DiscoverInductor.start(DiscoverInductor.java:242)
 at com.vontu.messaging.induction.InductorPool.start(InductorPool.java:172)
 at com.vontu.messaging.FileReader.start(FileReader.java:481)
 at com.vontu.messaging.FileReaderSetup.initialize(FileReaderSetup.java:110)
 at com.vontu.messaging.FileReader.main(FileReader.java:323)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in com.vontu.config.jpapersistence.JpaPersistenceSpringConfiguration: Invocation of init method failed; nested exception is java.lang.IllegalStateException: Conflicting persistence unit definitions for name 'CatalogEntryStorage': file:/E:/Program%20Files/Symantec/DataLossPrevention/ServerPlatformCommon/<version>/Protect/lib/jar/discovercatalog.jar, file:/E:/Program%20Files/Symantec/DataLossPrevention/ServerPlatformCommon/<version>/Protect/lib/jar/TBM540A.tmp
(...)
Oct 13, 2021 11:32:42 AM com.vontu.logging.LocalLogWriter write
SEVERE: File Reader failed to start. Error starting File Reader. java.lang.ExceptionInInitializerError. No incidents will be detected.

The filenames of the conflicting files can be different, but the reason is that there is a .tmp file left over from the MP installation which is conflicting with the .jar, causing the service to fail startup.

The installation log produced by the MP install may show entries similar to the below:

MSI (s) (7C:D4) [11:32:23:766]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1902 
Info 1903.Scheduling reboot operation: Deleting file E:\Program Files\Symantec\DataLossPrevention\ServerPlatformCommon\<version>\Protect\lib\jar\discovercatalog.jar. Must reboot to complete operation.

MSI (s) (7C:D4) [11:32:23:766]: Source for file 'Protectlibjardiscoverfilter.jar.133B00B4_6F1B_425E_B2F5_853543FA4816' is compressed
Info 1902.Scheduling reboot operation: Renaming file E:\Program Files\Symantec\DataLossPrevention\ServerPlatformCommon\<version>\Protect\lib\jar\TBM540A.tmp to E:\Program Files\Symantec\DataLossPrevention\ServerPlatformCommon\<version>\Protect\lib\jar\discovercatalog.jar. Must reboot to complete operation.

These entries say that the MP installer was unable to properly rename and delete the .tmp file used to create the .jar file, and requires a reboot to complete the operation. However, a reboot should not be required for an MP installation.

The following entries can also be present in the install log:

MSI (s) (7C:D4) [11:32:23:766]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1903 
Info 1603.The file E:\Program Files\Symantec\DataLossPrevention\ServerPlatformCommon\<version>\Protect\lib\jar\discovercatalog.jar is being held in use.  Close that application and retry.

This entry suggests that during the MP installation, there was actually something still using the jar files and preventing the MP deployment from being properly done.

Resolution

There are two possible solutions for this:

Remove the conflicting .tmp file from the referred folder. Do this for all files mentioned in the detector logs as preventing the server from a successful startup. Then try to start the service back up.
If removing the .tmp files does not help, uninstall and reinstall the detector, first the major version, and then the MP. To be sure, stop the DLP services manually before applying the MP.