Adding a detection server in Enforce fails with red banner and error "An unexpected error has occurred"

Products

• Data Loss Prevention Core Package

Issue/Introduction

You are attempting to add a new detection server in Server Overview on Enforce, however this fails and the red banner is displayed with the generic error:

"An unexpected error has occurred. This could be due to one of the following: 1) Your session timed out and you selected a link that was no longer valid, 2) You used the browser back or forward button placing the system into an inconsistent state, or 3) The system experienced a temporary problem"

Other issues may also be seen such as failure to collect server logs through the Enforce console. 

Cause

Double-check if the localhost logs on Enforce have any of the below entries around the time of the attempt to add a new detector on Enforce:

SEVERE [com.vontu.manager] [/CreateServer]
Cause:
com.vontu.util.config.ConfigurationException: Configuration parameter "SSLkeystore.dir" isn't set.com.vontu.util.config.ConfigurationException: Configuration parameter "SSLkeystore.dir" isn't set.

And this one could also be present around the time of an Enforce service startup (also in localhost log):

WARNING [com.vontu.manager.system.settings.ManagerConfiguration] Configuration file "C:\Program Files\Symantec\DataLossPrevention\EnforceServer\16.0.00000\Protect\config\Manager.properties" can't be read. Using hard-coded configuration values.

Resolution

The parameter SSLkeystore.dir is defined in Enforce's configuration file Manager.properties and tells Enforce the location of the ProgramData keystore folder (where Enforce keeps its keystores and truststores). If Enforce does not know where that folder is, you won't be able to add a new detection server on Enforce.

The two errors above, if found in localhost logs, mean that configuration file Manager.properties has been tampered with - i.e. renamed, moved or deleted from its original location. Enforce will still be able to start up and run even without that file, as it will fall back on hard-coded configuration values. But many parts of its functionality may be broken - log collection is another example. 

The solution is to check whether the Manager.properties file is still present in the Enforce config folder (by default C:\Program Files\Symantec\DataLossPrevention\EnforceServer\<version>\Protect\config) and either rename it back to the proper name, or recreate it from another running Enforce i.e. from the development environment.