DLP Endpoint Detection Server - FileReader fails to start - Detector service stuck in starting

Products

• Data Loss Prevention Endpoint Discover
• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Enterprise Suite

Issue/Introduction

DLP Endpoint Detection Server - FileReader fails to start

FileReader process stays on starting state for Endpoint Prevent Servers only, other detection servers on the console do start.

DLP 16.1 and Higher - The Detector service is stuck in "starting" state.

Environment

DLP 16.x , 25.x

Cause

Too many exceptions in a policy.

Error in the FileReader logs.

Class: com.vontu.messaging.FileReaderSetup
Method: initialize
Level: SEVERE
Message:  (DETECTION.3) Failed to initialize Detection
java.lang.ArithmeticException: long overflow
 at com.vontu.detection.dataaccessors.policy.executiontree.ExecutionMatrixMarshallableMemoryEstimator.computeRowsAndConditionUseStates(ExecutionMatrixMarshallableMemoryEstimator.java:192)
 at com.vontu.detection.dataaccessors.policy.executiontree.ExecutionMatrixMarshallableMemoryEstimator.computeApproximateMemoryInMBytes(ExecutionMatrixMarshallableMemoryEstimator.java:105)
 at com.vontu.policy.loader.execution.executiontree.integration.ExecutionTreeGenerator.generate(ExecutionTreeGenerator.java:126)

Errors in the SymantecDLPDetector Logs:

Level: SEVERE
Message:  Error while fetching data for dataId: GenericDataId [dataClassName=com.vontu.detection.dataaccessors.commandinstructions.CommandInstructionServer, Uuid=xxxxx, Uuid=xxxx, positiveInt31Value=0]
java.lang.ArithmeticException: long overflow
 at com.vontu.detection.dataaccessors.policy.executiontree.ExecutionMatrixMarshallableMemoryEstimator.computeRowsAndConditionUseStates(ExecutionMatrixMarshallableMemoryEstimator.java:191)
 at 

Level: SEVERE
Message:  Unexpected exception for topic POLICY.[Ljava.lang.StackTraceElement

Resolution

Review all the policies that have been modified recently or right before the start of the issue.

Suspend the problem policy and validate FileReader/Detector service starts.

Fine-tune the policy, reduce the exceptions and redeploy.