DLP Scanfilters (Application Detection configuration) stuck in sync pending

Products

• Data Loss Prevention Cloud Detection Service for REST

Issue/Introduction

You have found that the "Sync to CloudSOC" operation in the Enforce Server never completes the sync, the status remaining as "Sync Pending".

Environment

Release : 15.8

Component :

Cause

Logs show errors with regard to the SPI request, from the MonitorController0.log:

May 17, 2022 2:09:17 PM com.symantec.dlp.communications.applicationcommunicatorlayer.HomogeneousReceiverApplicationCommunicator$HomogeneousReceiverDataAcceptor$ApplicationProcessingTask run
WARNING: Unexpected exception occurred for com.symantec.dlp.communications.applicationcommunicatorlayer.ApplicationConnection@2c03aeca
java.lang.NullPointerException: Name is null
at java.lang.Enum.valueOf(Enum.java:236)
at com.vontu.dataconstants.rest.RestSPIRequestStatus.valueOf(RestSPIRequestStatus.java:30)
at com.symantec.dlp.services.rest.mapper.RestSPIRequestMapper.convert(RestSPIRequestMapper.java:72)
at com.symantec.dlp.services.rest.SpiResponseMonitorControllerApplicationService.onReceived(SpiResponseMonitorControllerApplicationService.java:75)
at com.symantec.dlp.services.rest.SpiResponseMonitorControllerApplicationService.onReceived(SpiResponseMonitorControllerApplicationService.java:52)
at com.symantec.dlp.communications.applicationcommunicatorlayer.HomogeneousReceiverApplicationCommunicator$HomogeneousReceiverDataAcceptor$ApplicationProcessingTask.run(HomogeneousReceiverApplicationCommunicator.java:280)
at com.symantec.dlp.util.concurrent.DeadlineTaskQueue$DeadlineTask.run(DeadlineTaskQueue.java:254)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
May 17, 2022 2:09:17 PM com.symantec.dlp.communications.applicationcommunicatorlayer.ApplicationCommunicatorActivityNotifiableImpl onRetryUponRecoverableApplicationException
WARNING: OnRetry after encountering a recoverable applcation exception for com.symantec.dlp.communications.applicationcommunicatorlayer.ApplicationConnection@2c03aeca and the replicatorId is Replicator(21,'SPI_RESPONSE'). Will retry in 10 seconds.

Resolution

First, confirm your setup doesn't involve a prior DLP Cloud Detection Server for REST for which you also setup an Application filter for Web Security Services (aka "Cloud Web Proxy"):

Application Detection never changes "Sync Pending" status (broadcom.com)

If that does not apply, and the logs report the error in this article, you should open a case with Technical Support.