Custom Attribute lookup failure severe events code 2115 captured on DLP Enforce

Products

• Data Loss Prevention Enforce
• Data Loss Prevention

Issue/Introduction

Several incidents are not populating attributes automatically, however manually looked up populate ok.

Cause

In some environments, extending the AttributeLookup.timeout from the default of 60,000 (in milliseconds) can assist with querying the AD and allow more time for a return of data to populate the custom attributes automatically without the need for manual lookup.

Note that increasing this value may result in slower incident processing times because of slow attribute lookups.

Resolution

On the Enforce server open the following file ‘Plugins.properties’ in notepad to modify

The default path to the Plugins.properties file is as follows:

Windows:

C:\Program Files\Symantec\DataLossPrevention\EnforceServer\<version>\Protect\config\Plugins.properties

Linux:

/opt/Symantec/DataLossPrevention/EnforceServer/<version>/Protect/config/Plugins.properties

Increase the time out for the value.

"com.vontu.api.incident.attributes.AttributeLookup.timeout"

(default value is 60000 milliseconds) – change to 300000

Then save the plugins.properties configuration file.

Restart the Enforce services after making any change in the Plugins.properties configuration file as per KB 159970: 
Restart DLP Enforce services in the correct order

Additional Information

Configuring advanced plug-in properties 16.1 link:
Configuring advanced plug-in properties