DLP EDPA service stops or crashes and switch's to manual start.

Products

• Data Loss Prevention Network Monitor and Prevent for Email

Issue/Introduction

EDPA Service stops and goes into manual, due to a failure while initialization of the third party boost synchronization object.

Environment

16.0 MP2

Cause

While EDPA Startup, LiveUpdateSerivce in its initilization which inturn creates LiveUpdateMessageHandler object.

In the construction of the LiveUpdateMessageHandler it creates boost synchronization objects. While creating these objects on Windows OS it checks for a System Event 6005, if its not found then the it throws and error mentioned below:

10/20/2023 17:02:57 | 4232 | SEVERE | AgentServices.LiveUpdateService | Failed to create eventStateUpdateCondition or eventStateUpdateMutex. Exception error code = boost::interprocess::intermodule_singleton initialization failed

In this scenario EDPA service is shutdown gracefully.

Steps to Reproduce:

Stop EDPA service on an endpoint.

• Go to Event Viewer and clear all Application and System Events. If this is not possible, then one needs to at least delete all events of event ID 6005 from SYSTEM events list. Check snapshot below.
• Go to 'services.msc' and change EDPA and WDP services to 'manual' instead of default value of 'Automatic'.
• Restart the system.
• After reboot, notice that EDPA is stopped.
• Again open Event Viewer, delete all events - basically same as step no. 2 above.
• Start EDPA. Observe that EDPA stops immediately.

Resolution

This issue has been fixed in 16.0RU1MP and 16.0 RU2 versions of DLP.

Additional Information

Similar log entries may be seen on 15.8 MP3 as well as it does not fail because the code is different to handle this error.

In 15.8 MP3 only the error is logged and the error code was not thrown as an exception and hence further components are loaded successfully.