ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Data Protection - xmlattr does not work on email attachment trigger


Article ID: 6401


Updated On:


SINGLE SIGN ON - LEGACY CA Data Protection (DataMinder) CA User Activity Reporting


XML Attribute lookups (xmlattr) can be used to detect metadata attributes of events. This metadata is stored in XML format. This allows policy triggers to access event information that is not accessible through any other trigger.  XML metadata contains ancillary information about the item itself (for example, when a file was created or an x-header inserted into an Internet Mail).


The General release (GA) versions of CA Data Protection 15.x has some limitations that cause it to do not work on email attachment triggers.


The General release (GA) versions of CA Data Protection 15.x were not coded for this type of lookup.


CA Data Protection 15.x


Fixes have been released for Data protection 15.0 (FIX:RO93042) and 15.2 (FIX:RO99984)which enhances the support of XMLATTR data lookups to handle email attachment count, attachment name and attachment size for emails generated from the following component features :

1. EMC SourceOne agent

2. PST Importer


FIX:RO93042 (incorporating Integration_x64_15.0_HF068 and Server_x64_15.0_HF069) and

FIX:RO99984 (incorporating Integration_x64_15.20_HF0134 and Server_x64_15.20_HF0133)

are available to download from the CA Support Portal (



Additional Information

Sample XMLATTR command-1:

The following data lookup command would trigger when the email attachment extension is either jpeg or png, and the size of attachments is in the range of 10000 Bytes to 20000 Bytes.


(xmlattr WITH apm/event/email/attachments/attachment WHERE (name IS ANY{ "*.jpeg", "*.png"}) AND (size > 10000) AND (SIZE < 20000))


Sample XMLATTR command-2:


The following data lookup command would trigger when the number of email attachments is more than two.


(xmlattr WHERE apm/event/email/attachments/count > 2)