Error 4808 (Unknown) reported on DLP detection servers

Products

• Data Loss Prevention
• Data Loss Prevention Network Email
• Data Loss Prevention Network Monitor and Prevent for Email and Web
• Data Loss Prevention Network Prevent for Email
• Data Loss Prevention Sensitive Image Recognition

Issue/Introduction

4804 (Unknown) errors are reported in the Enforce Console for a Detection server using OCR.

The FileReader.log on the Detection server shows the following:

com.vontu.messaging.chain.ocr.OcrExecutionTask call
WARNING: Failed to perform OCR for item 'image_extractor_plugin_embedded_image'
java.lang.OutOfMemoryError: Direct buffer memory
    at java.nio.Bits.reserveMemory(Bits.java:694)
    at java.nio.DirectByteBuffer.<init>(DirectByteBuffer.java:123)
    at java.nio.ByteBuffer.allocateDirect(ByteBuffer.java:311)
    at com.symantec.dlp.util.jni.memory.ByteBufferContainer.<init>(ByteBufferContainer.java:81)
    at com.symantec.dlp.util.jni.memory.DirectByteBufferPool2.<init>(DirectByteBufferPool2.java:72)
    at com.symantec.dlp.util.jni.memory.DirectByteBufferHelper$2.initialValue(DirectByteBufferHelper.java:117)
    at com.symantec.dlp.util.jni.memory.DirectByteBufferHelper$2.initialValue(DirectByteBufferHelper.java:114)
    at java.lang.ThreadLocal.setInitialValue(ThreadLocal.java:180)
    at java.lang.ThreadLocal.get(ThreadLocal.java:170)
    at com.symantec.dlp.util.jni.memory.DirectByteBufferHelper.getByteBufferHandle(DirectByteBufferHelper.java:132)
    at com.symantec.dlp.util.jni.memory.CharSequenceBuffer.allocateInternalBuffer(CharSequenceBuffer.java:353)
    at com.symantec.dlp.util.jni.memory.CharSequenceBuffer.<init>(CharSequenceBuffer.java:103)
    at com.vontu.util.unicode.UnicodeNormalizer.standardNormalize(UnicodeNormalizer.java:217)
    at com.vontu.util.unicode.UnicodeNormalizer.customNormalize(UnicodeNormalizer.java:183)
    at com.vontu.util.unicode.UnicodeNormalizer.checkAndNormalize(UnicodeNormalizer.java:450)
    at com.vontu.util.unicode.UnicodeNormalizer.normalize(UnicodeNormalizer.java:421)
    at com.vontu.util.unicode.UnicodeNormalizer.normalize(UnicodeNormalizer.java:405)
    at com.vontu.classification.api.referenceimpl.LazyNormalizedCharContent.processChars(LazyNormalizedCharContent.java:53)
    at com.vontu.classification.api.referenceimpl.LazyProcessedCharContent.setProcessedChars(LazyProcessedCharContent.java:66)
    at com.vontu.classification.api.referenceimpl.LazyProcessedCharContent.getCharSequence(LazyProcessedCharContent.java:57)
    at com.vontu.messaging.chain.ocr.OcrExecutionTask.call(OcrExecutionTask.java:157)
    at com.vontu.messaging.chain.ocr.OcrExecutionTask.call(OcrExecutionTask.java:60)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)

Environment

Symantec Data Loss Prevention 15.8.x

Cause

FileReader does not have enough memory to engage OCR at the time the error occurred. 

Resolution

Allocate more memory to FileReader.

1. In the Enforce Console, navigate to System > Servers and Detectors > Select the detection servers seeing the error > Server Settings.
2. Search for: BoxMonitor.FileReaderMemory
3. Increase the memory as needed
   

   For example:
   Default value is 4GB 
   BoxMonitor.FileReaderMemory = -Xrs -Xms1200M -Xmx4G

   Try increasing it to 6GB
   BoxMonitor.FileReaderMemory = -Xrs -Xms1200M -Xmx6G

4. Save your changes
5. Restart the DLP service on the Detection server to apply the change.