search cancel

Error 4808 (Unknown) reported on DLP detection servers

book

Article ID: 257300

calendar_today

Updated On:

Products

Data Loss Prevention Data Loss Prevention Network Email Data Loss Prevention Network Monitor and Prevent for Email and Web Data Loss Prevention Network Prevent for Email Data Loss Prevention Sensitive Image Recognition

Issue/Introduction

4804 (Unknown) errors are reported in the Enforce Console for a Detection server using OCR.

The FileReader.log on the Detection server shows the following:

com.vontu.messaging.chain.ocr.OcrExecutionTask call
WARNING: Failed to perform OCR for item 'image_extractor_plugin_embedded_image'
java.lang.OutOfMemoryError: Direct buffer memory
    at java.nio.Bits.reserveMemory(Bits.java:694)
    at java.nio.DirectByteBuffer.<init>(DirectByteBuffer.java:123)
    at java.nio.ByteBuffer.allocateDirect(ByteBuffer.java:311)
    at com.symantec.dlp.util.jni.memory.ByteBufferContainer.<init>(ByteBufferContainer.java:81)
    at com.symantec.dlp.util.jni.memory.DirectByteBufferPool2.<init>(DirectByteBufferPool2.java:72)
    at com.symantec.dlp.util.jni.memory.DirectByteBufferHelper$2.initialValue(DirectByteBufferHelper.java:117)
    at com.symantec.dlp.util.jni.memory.DirectByteBufferHelper$2.initialValue(DirectByteBufferHelper.java:114)
    at java.lang.ThreadLocal.setInitialValue(ThreadLocal.java:180)
    at java.lang.ThreadLocal.get(ThreadLocal.java:170)
    at com.symantec.dlp.util.jni.memory.DirectByteBufferHelper.getByteBufferHandle(DirectByteBufferHelper.java:132)
    at com.symantec.dlp.util.jni.memory.CharSequenceBuffer.allocateInternalBuffer(CharSequenceBuffer.java:353)
    at com.symantec.dlp.util.jni.memory.CharSequenceBuffer.<init>(CharSequenceBuffer.java:103)
    at com.vontu.util.unicode.UnicodeNormalizer.standardNormalize(UnicodeNormalizer.java:217)
    at com.vontu.util.unicode.UnicodeNormalizer.customNormalize(UnicodeNormalizer.java:183)
    at com.vontu.util.unicode.UnicodeNormalizer.checkAndNormalize(UnicodeNormalizer.java:450)
    at com.vontu.util.unicode.UnicodeNormalizer.normalize(UnicodeNormalizer.java:421)
    at com.vontu.util.unicode.UnicodeNormalizer.normalize(UnicodeNormalizer.java:405)
    at com.vontu.classification.api.referenceimpl.LazyNormalizedCharContent.processChars(LazyNormalizedCharContent.java:53)
    at com.vontu.classification.api.referenceimpl.LazyProcessedCharContent.setProcessedChars(LazyProcessedCharContent.java:66)
    at com.vontu.classification.api.referenceimpl.LazyProcessedCharContent.getCharSequence(LazyProcessedCharContent.java:57)
    at com.vontu.messaging.chain.ocr.OcrExecutionTask.call(OcrExecutionTask.java:157)
    at com.vontu.messaging.chain.ocr.OcrExecutionTask.call(OcrExecutionTask.java:60)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)

Environment

Symantec Data Loss Prevention 15.8.x

Cause

FileReader does not have enough memory to engage OCR at the time the error occurred. 

Resolution

Allocate more memory to FileReader.

  1. In the Enforce Console, navigate to System > Servers and Detectors > Select the detection servers seeing the error > Server Settings.
  2. Search for: BoxMonitor.FileReaderMemory
  3. Increase the memory as needed

    For example:
    Default value is 4GB 
    BoxMonitor.FileReaderMemory = -Xrs -Xms1200M -Xmx4G

    Try increasing it to 6GB
    BoxMonitor.FileReaderMemory = -Xrs -Xms1200M -Xmx6G

  4. Save your changes
  5. Restart the DLP service on the Detection server to apply the change.