Event code 1213 "Messages timed out in detection"

Products

• Data Loss Prevention Cloud Prevent for Microsoft Office 365
• Data Loss Prevention Network Monitor
• Data Loss Prevention Network Prevent for Email
• Data Loss Prevention Enforce
• Data Loss Prevention Network Monitor and Prevent for Web

Issue/Introduction

Event code 1213 (" x# of Messages timed out in detection")  is appearing in the Enforce console System Events.

File Reader logs on the detection server may show:

INFO: Detection timed out on message [xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx]

Where x = an alphanumeric character

Cause

Event Code 1213 was introduced in an earlier version of DLP.

The message will be delivered unless detection had sufficient time to wholly determine a block rule was necessary.

 

 

 

Resolution

DLP does have the ability to add a modified header in messages that timed out in detection.

This is specific to Network Prevent for Email. This can be turned on or off in the advanced server settings by modifying the 'RequestProcessor.AddHeaderOnMessageTimeout' value. The default value is false. Enabling this will add a descriptive header message that will allow email administrators to change how the message is handled down stream.

See this Help Center topic: Advanced server settings (broadcom.com) for further detail

 

 

Additional Information

For more information about timeout settings in DLP, see this article: In an overloaded environment, detection process is timing out (broadcom.com).