Symantec DLP Incident Persister fails to run after reboot

Products

• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

After a reboot of the Enforce server, the Symantec DLP Incident Persister Service appears to start, but stops within a few minutes.

The IncidentPersister_0.log shows the following:

(SEVERE) Thread: 18 [org.apache.catalina.core.StandardService.addConnector] Failed to start connector [Connector[HTTP/1.1-9000]]
org.apache.catalina.LifecycleException: Failed to start component [Connector[HTTP/1.1-9000]]
 at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:167)
 at org.apache.catalina.core.StandardService.addConnector(StandardService.java:225)
 at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.addPreviouslyRemovedConnectors(TomcatWebServer.java:256)
 at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.start(TomcatWebServer.java:198)
 at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.startWebServer(ServletWebServerApplicationContext.java:300)
 at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.finishRefresh(ServletWebServerApplicationContext.java:162)
 at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:553)
 at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:140)
 at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:759)
 at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:395)
 at org.springframework.boot.SpringApplication.run(SpringApplication.java:327)
 at com.vontu.incidenthandler.IncidentPersister.start(IncidentPersister.java:142)
 at com.vontu.incidenthandler.IncidentPersister.main(IncidentPersister.java:251)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at org.tanukisoftware.wrapper.WrapperSimpleApp.run(WrapperSimpleApp.java:325)
 at java.lang.Thread.run(Thread.java:748)
Caused by: org.apache.catalina.LifecycleException: Protocol handler start failed
 at org.apache.catalina.connector.Connector.startInternal(Connector.java:1020)
 at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
 ... 18 more
Caused by: java.net.BindException: Address already in use: bind
 at sun.nio.ch.Net.bind0(Native Method)
 at sun.nio.ch.Net.bind(Net.java:433)
 at sun.nio.ch.Net.bind(Net.java:425)
 at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:220)
 at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:85)
 at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:210)
 at org.apache.tomcat.util.net.AbstractEndpoint.start(AbstractEndpoint.java:1150)
 at org.apache.coyote.AbstractProtocol.start(AbstractProtocol.java:591)
 at org.apache.catalina.connector.Connector.startInternal(Connector.java:1018)
 ... 19 more

***************************
APPLICATION FAILED TO START
***************************

Description:
The Tomcat connector configured to listen on port 9000 failed to start. The port may already be in use or the connector may be misconfigured.

Action:
Verify the connector's configuration, identify and stop any process that's listening on port 9000, or configure this application to listen on another port.

Environment

Symantec Data Loss Prevention 15.8 GA
Windows 2012 R2

Cause

Port 9000 is already in use.

Resolution

A reboot of the server will free up the port.

If a reboot is not an option, or doesn't work, you can use the following steps to determine which service is using the port:
1. On the Enforce server, open Command Line and run the following command to collect the PID of the service using port 9000:

netstat -ano | find "9000"

Note:  the PID is the last number listed in the results.


2. Open Task Manager > Details tab > search for the PID. This will show you which service is using the port.
3. If the service is one that you have permission to stop, right-click on the service and end task.
4. Rerun the netstat command to confirm port 9000 is not being used.


5. Restart the Symantec DLP Incident Persister Service