Slow Incident processing due to lookup plugin warnings as SQL query did not return any results, update CSV file and reload plugin

Products

• Data Loss Prevention
• Data Loss Prevention Cloud Package
• Data Loss Prevention Core Package
• Data Loss Prevention Discover Suite
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Enforce
• Data Loss Prevention Plus Suite

Issue/Introduction

Slow Incident processing on enforce or may end up in high backlog due to lookup plugin warnings as below in Incident persister logs.

Level: WARNING
Thread: 4404
Source: com.vontu.lookup.csv.DerbyDatabaseAdapter.queryLookupAttribute
Message: SQL query did not return any results, update CSV file and reload plugin

Environment

Release : 16.x / 15.8

 

Resolution

• Login to Enforce Server
• Go to System > Incident Data > Lookup Plugin
• Check list for the Plugin type as CSV
• Make sure that all configuration for this plugin is completed properly.
• Once the changes are saved then perform Reload Plugins.

Additional Information

If the incident backlog is high then turning this plugin OFF can help reduce the backlog as workaround until the plugin initialization is fully resolved.