DLP Detection Servers Remain in "Starting" State or Show "Unknown" Status after upgrade or Enforce failover.

Products

• Data Loss Prevention Core Package

Issue/Introduction

Detection servers fail to connect to the Enforce Server following a disaster recovery (DR) failover or restart. The Enforce console displays an "Unknown" status, and detection logs show the message: SEVERE: Continue waiting for resource. This occurs even if the Enforce Connector service indicates a successful connection.

Monitor controller logs also show missing such as keystore files:
WARNING: Failed to get keystore data for provision id

Environment

• Data Loss Prevention 16.1 and later
• Disaster Recovery configurations with a Standby Enforce Server

Cause

The Enforce Monitor Controller must build a replication cache in memory for all detection servers upon startup. If any files are missing between Enforces such as a keystore (.jks) file associated with detection server are missing from the Enforce Server file system, the Monitor Controller cannot build this cache. As a result, an empty configuration is sent to the detection servers, causing them to hang indefinitely while waiting for basic settings.

In DR environments, this typically happens when the database is replicated, but the physical files located in the Enforce installation directory are not manually copied to the standby node.

Resolution

1. Restore the missing keystore files to the DR Enforce Server to allow the replication cache to build correctly.

   1. Identify missing files: Review the MonitorController logs on the Enforce Server for WARNING or SEVERE errors indicating a failure to get provisioned data. Note the specific file names and paths (e.g., ...\keystore\*.jks).
   2. Locate source files: Access the Primary Enforce Server. Navigate to the keystore directory: \ProgramData\Symantec\DataLossPrevention\EnforceServer\[Version]\keystore\.
   3. Transfer files: Copy the identified files from the Primary Enforce Server to the identical directory path on the DR Enforce Server.
   4. Rebuild cache: Restart the Symantec DLP Detection Server Controller service on the Enforce Server.
   5. Initialize detection: Restart the Symantec DLP Detector and Symantec DLP Enforce Connector services on the affected detection servers.
   6. Verify status: Confirm the detection servers transition to a "Running" state in the Enforce console.