Office apps hang or behave abnormally

book

Article ID: 239733

calendar_today

Updated On:

Products

Data Loss Prevention Data Loss Prevention Endpoint Prevent

Issue/Introduction

Customers may experience abnormal behavior of office apps for e.g. Outlook hangs while sending attachments. Office apps hang during and saving OneDrive files.
 
Logs snippet:
 
04/06/2022 11:28:13 | 6848 | WARNING | Detection.ContentService | ExtractTextStreamToStream timed out | OfficeOpenXMLExtractor.cs(370)
04/06/2022 11:28:13 | 6848 | WARNING | Detection.ContentService | A task may only be disposed if it is in a completion state (RanToCompletion, Faulted or Canceled). StackTrace at System.Threading.Tasks.Task.Dispose(Boolean disposing)
at System.Threading.Tasks.Task.Dispose()
at OfficeOpenXMLContentExtractor.OfficeOpenXMLExtractor.ExtractTextStreamToStream(IntPtr pluginContextPtr, IntPtr docTypePtr, IntPtr textExtractionOptionsPtr, IntPtr inStream, IntPtr outStream, IntPtr textExtractionEncodingPtr) | OfficeOpenXMLExtractor.cs(394)
04/06/2022 11:28:13 | 6848 | WARNING | Detection.ContentService | ExtractTextStreamToStream failed | OfficeOpenXMLPluginLib.cpp(438)
04/06/2022 11:28:13 | 6848 | FINE | Detection.SPITextExtractor | Could not extract text! Error code: [1]
04/06/2022 11:28:13 | 6848 | FINER | Detection.TempFile | Removed temporary file C:\ep_test\agentDir\temp/buffer\1\1.
04/06/2022 11:28:13 | 6848 | WARNING | Detection.ContentService | [Ooxml] text extraction of [C:\Testdata\BrowserPrintMonitoring\Feb2021_PrintMonitoring_TestData\Sensitive\hang_issuefile -.xlsx], type=[xlsx]: caught system error [ExtractText call failed!: Incorrect function.
] with code [system:1]

Cause

This is due to an issue with the new Content Extractor that was shipped with DLP 15.8.x and this is the default option used for Office files now.

Environment

15.8.x

Resolution

As a workaround, customers can go to Advanced Agent settings and change the value of 'Detection.OFFICE_OPEN_XML_ENABLED.str' from its default value of 'on' to 'off'. By turning this setting off, the agent will fall back to the 15.7-era Verity-based content extractor.

Additional Information

A fix is planned in the DLP 15.8 MP3 release.