DLP Discover scan does not start

Products

• Data Loss Prevention
• Data Loss Prevention Discover Suite
• Data Loss Prevention Network Discover

Issue/Introduction

After performing disaster recovery steps to move the DLP 15.8 Enforce Server to new hardware, Discover scans no longer run.

Scans can be created and scheduled. However, once the scheduled start time arrives, the Enforce Console only shows the scan reset the scan start time to the next scheduled date. 
Scan history does not log any attempt to start the scan. 
Checking the target Discover Server, the ScanDetail log isn't created and FileReader logs do not show any indication a scan was assigned.

Services were restarted on both the Enforce and Discover Servers.
Discover Servers show as connected in the Enforce Console.

Navigating to System > Servers and Detectors > Overview > select the Discover Server, we see policies have not been replicated since the Enforce Server was moved.

Cause

Monitor Controller did not have enough memory to process the Discover scans.

Resolution

1. On the Enforce Server, increase the java settings in SymantecDLPManager.conf.
   
   Example:
   # Initial Java Heap Size (in MB)
wrapper.java.initmemory = 1378

# Maximum Java Heap Size (in MB)
wrapper.java.maxmemory = 2048
   
   
   Increase to:
   # Initial Java Heap Size (in MB)
wrapper.java.initmemory = 2048

# Maximum Java Heap Size (in MB)
wrapper.java.maxmemory = 4096
   
   
   
2. Restarted services on the Enforce Server.
3. The Enforce Console now shows policies replicating successfully to the Discover Servers. Discover scans also start successfully.