Issues with Office app hung or abnormal behavior when DLP services are running.

Products

• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

Users experience abnormal behavior of office apps for e.g. Outlook hangs while sending attachments. Office apps hang during/saving OneDrive files.

 

Logs snippet:

 

04/06/2022 11:28:13 | 6848 | WARNING | Detection.ContentService | ExtractTextStreamToStream timed out | OfficeOpenXMLExtractor.cs(370)
04/06/2022 11:28:13 | 6848 | WARNING | Detection.ContentService | A task may only be disposed if it is in a completion state (RanToCompletion, Faulted or Canceled). StackTrace at System.Threading.Tasks.Task.Dispose(Boolean disposing)
at System.Threading.Tasks.Task.Dispose()
at OfficeOpenXMLContentExtractor.OfficeOpenXMLExtractor.ExtractTextStreamToStream(IntPtr pluginContextPtr, IntPtr docTypePtr, IntPtr textExtractionOptionsPtr, IntPtr inStream, IntPtr outStream, IntPtr textExtractionEncodingPtr) | OfficeOpenXMLExtractor.cs(394)
04/06/2022 11:28:13 | 6848 | WARNING | Detection.ContentService | ExtractTextStreamToStream failed | OfficeOpenXMLPluginLib.cpp(438)
04/06/2022 11:28:13 | 6848 | FINE | Detection.SPITextExtractor | Could not extract text! Error code: [1]
04/06/2022 11:28:13 | 6848 | FINER | Detection.TempFile | Removed temporary file C:\ep_test\agentDir\temp/buffer\1\1.
04/06/2022 11:28:13 | 6848 | WARNING | Detection.ContentService | [Ooxml] text extraction of [C:\Testdata\BrowserPrintMonitoring\Feb2021_PrintMonitoring_TestData\Sensitive\hang_issuefile -.xlsx], type=[xlsx]: caught system error [ExtractText call failed!: Incorrect function.
] with code [system:1]

Environment

15.8.x

Cause

This is caused due to an issue with the new content extractor that was shipped with DLP 15.8.x and this is the default option used for Office files now.

Resolution

A fix is planned in the future version of DLP release, following Workaround in the Agent configuration can be used. 

• Login to Enforce Server
• Go to Server > Agent >  Agent Configuration
• Go to Advanced Agent settings
• Change the value of 'Detection.OFFICE_OPEN_XML_ENABLED.str' from its default value of 'on' to 'off'. (By turning this setting off, the agent will fall back to the 15.7-era Verity-based content extractor.
• Save Agent Configuration
• Apply Agent Configuration.