How to implement debug logging for flexresponse issues

Products

• Data Loss Prevention

Issue/Introduction

The user has encountered an issue with their flexresponse rules such as release from quarantine failing, the localhost logs in their default configuration do not provide enough information. In order to troubleshoot the issue support requires verbose log data which may be achieved by implementing the below steps.

 

Resolution

For the verbose logging we need to add the following to ManagerLogging.properties

com.vontu.incidentresponse.level = FINEST

com.vontu.incidenthandler.command.level = FINEST

com.vontu.command.level = FINEST

com.symantec.dlpx.flexresponse.level = FINEST

com.vontu.manager.command.level = FINEST

And make

org.apache.juli.FileHandler.level = FINEST

This will require services on enforce to be restarted.