Toronto Data Loss Prevention User Group

 View Only
Back to discussions
Expand all | Collapse all

Icap error in WebPrevent_Operational.log in Symantec DLP

  • 1.  Icap error in WebPrevent_Operational.log in Symantec DLP

    Posted Jan 17, 2018 03:44 PM

    Hello,

    Checked the WebPrevent_Operational.log. Found the below

    16/Jan/18:16:21:01:498-0500 [INFO] (ICAP_CONNECTION.1201) Connection (cid=17021) opened from host(172.24.25.2:27428).

    16/Jan/18:16:21:01:498-0500 [INFO] (ICAP_CONNECTION.1203) Connection stat: REQMOD=0, RESPMOD=0, OPTIONS=0, OTHERS=5.

    16/Jan/18:16:32:12:901-0500 [INFO] (ICAP_CONNECTION.1202) Connection (cid=17021) closed(EOF).

    This error was generated when the user was trying to send 14GB data over the network. Connection goes like this from User->proxy servers->load balancers(172.24.25.2:27428)-> DLP. Above log states clearly that the connection is open from load balancer side, after a certain period we receive EOF. Is it because of filesize we are using??  Also we are able to send smaller files. This is the first time we are facing this issue.

    Please help.



  • 2.  RE: Icap error in WebPrevent_Operational.log in Symantec DLP

    Posted Jan 17, 2018 03:55 PM

    You need to post this in the DLP forum, which is here:

    https://www.symantec.com/connect/security/forums/data-loss-prevention-vontu



  • 3.  RE: Icap error in WebPrevent_Operational.log in Symantec DLP

    Posted Jan 18, 2018 12:06 PM

    Okay! 

    Thank you Brian.



  • 4.  RE: Icap error in WebPrevent_Operational.log in Symantec DLP
    Best Answer

    Posted Jan 18, 2018 12:09 PM

    You're welcome.