Deadlock errors when access csv plugin

Products

• Data Loss Prevention

Issue/Introduction

When the lookup plugins fail with a deadlock message in the IncidentPersister_0.log

Environment

RHEL 8.x 

DLP 16.x 

Cause

To determine the cause in this case we have to see what other process is creating a lock on the file. This could be backup software, antivirus, etc.. The following utilities can be usedd to troubleshoot, inotifywait and auditd.

Resolution

With the use of a couple utilities to be able to determine which processes are creating deadlocks on the file

inotifywait:

using inotifywait requires the installation of inotify-tools that resides int he EPEL-release repo. To enable the EPEL-release repo do teh below steps:

sudo subscription-manager repos --enable "codeready-builder-for-rhel-8-$(arch)-rpms"
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
sudo yum update
sudo yum install ionotify-tools

to run inotifywait 

inotifywait -m /path/to/file

auditd:

auditd is available on a base install of rhel

to run auditctl and ausearch 

sudo auditctl -w /path/to/file -p r -k filewatch
ausearch -k filewatch

Additional Information

inotifywait will just show the open and close of a file.  for example

 

auditctl will give more detailed information on when the file was opened and by what program. For example: