Collecting Detection Server logs in the Enforce Console hangs, and never completes.

Products

• Data Loss Prevention
• Data Loss Prevention Enforce
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention Discover Suite
• Data Loss Prevention Plus Suite

Issue/Introduction

When collecting Detection Server logs from the Enforce Console, the task hangs and never completes the process. You must cancel the attempt before you can do anything else. When checking the MonitorController logs, you see the following error message...

File: Enforce/logs/debug/MonitorController0.log
Date: 1/15/2025 1:47:31 PM
Class: com.symantec.dlp.services.log.FileStreamDataAcceptorUDS
Method: onReplicationComplete
Level: WARNING
Message:  [Replicator(36,'LogCollect')]  error occurred while processing the content for data id '<filename.zip>'
java.nio.file.AtomicMoveNotSupportedException: /var/Symantec/DataLossPrevention/EnforceServer/16.1.00000/temp/<filename.tmp> -> /var/log/Symantec/DataLossPrevention/EnforceServer/16.1.00000/collections/69264/<DetectionServerName>/<filename.zip>: Invalid cross-device link
    at sun.nio.fs.UnixCopyFile.move(UnixCopyFile.java:394)
    at sun.nio.fs.UnixFileSystemProvider.move(UnixFileSystemProvider.java:262)
    at java.nio.file.Files.move(Files.java:1395)
    at com.symantec.dlp.services.log.FileReceiverUDS.onReplicationComplete(FileReceiverUDS.java:110)
    at com.symantec.dlp.services.log.FileStreamDataAcceptorUDS.onReplicationComplete(FileStreamDataAcceptorUDS.java:156)
    at com.symantec.dlp.cloudapplicationcommon.applicationcommunicator.HomogeneousSerializedReceiverApplicationCommunicator$HomogeneousReceiverDataAcceptor$ApplicationProcessingTask.run(HomogeneousSerializedReceiverApplicationCommunicator.java:304)
    at com.symantec.dlp.util.concurrent.DeadlineTaskQueue$DeadlineTask.run(DeadlineTaskQueue.java:254)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:750)

Environment

RHEL
DLP 16.1 GA

Cause

When DLP attempts to copy from the "temp" directory to the "logs" directory it fails with an "AtomicMoveNotSupportedException" error message. AtomicMove will fail when the two locations (temp and logs) are using different Mount Points.

Resolution

Upgrade to DLP 16.1 MP1

Additional Information

The issue appears to have been introduced in DLP 16.1 GA, and the fix is expected to be released in DLP 16.1 MP1.