DLP Scanfilters (Application Detection configuration) stuck in sync pending

Products

• Data Loss Prevention Cloud Detection Service for REST

Issue/Introduction

You have found that the "Sync to CloudSOC" operation in the Enforce Server never completes the sync, the status remaining as "Sync Pending".

Cause

Logs show errors with regard to the SPI request, from the MonitorController0.log:

May 17, 2022 2:09:17 PM com.symantec.dlp.communications.applicationcommunicatorlayer.HomogeneousReceiverApplicationCommunicator$HomogeneousReceiverDataAcceptor$ApplicationProcessingTask run
WARNING: Unexpected exception occurred for com.symantec.dlp.co[email protected]2c03aeca
java.lang.NullPointerException: Name is null
at java.lang.Enum.valueOf(Enum.java:236)
at com.vontu.dataconstants.rest.RestSPIRequestStatus.valueOf(RestSPIRequestStatus.java:30)
at com.symantec.dlp.services.rest.mapper.RestSPIRequestMapper.convert(RestSPIRequestMapper.java:72)
at com.symantec.dlp.services.rest.SpiResponseMonitorControllerApplicationService.onReceived(SpiResponseMonitorControllerApplicationService.java:75)
at com.symantec.dlp.services.rest.SpiResponseMonitorControllerApplicationService.onReceived(SpiResponseMonitorControllerApplicationService.java:52)
at com.symantec.dlp.communications.applicationcommunicatorlayer.HomogeneousReceiverApplicationCommunicator$HomogeneousReceiverDataAcceptor$ApplicationProcessingTask.run(HomogeneousReceiverApplicationCommunicator.java:280)
at com.symantec.dlp.util.concurrent.DeadlineTaskQueue$DeadlineTask.run(DeadlineTaskQueue.java:254)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
May 17, 2022 2:09:17 PM com.symantec.dlp.communications.applicationcommunicatorlayer.ApplicationCommunicatorActivityNotifiableImpl onRetryUponRecoverableApplicationException
WARNING: OnRetry after encountering a recoverable applcation exception for com.symantec.dlp.co[email protected]2c03aeca and the replicatorId is Replicator(21,'SPI_RESPONSE'). Will retry in 10 seconds.

Environment

Release : 15.8

Component :

Resolution

First, confirm your setup doesn't involve a prior DLP Cloud Detection Server for REST for which you also setup an Application filter for Web Security Services (aka "Cloud Web Proxy"):

Application Detection never changes "Sync Pending" status (broadcom.com)

If that does not apply, and the logs report the error in this article, you should open a case with Technical Support.