Service IncidentPersister does not start

[Huggenberger Andre]

The Service IncidentPersister does not start because an IBM Cloud Monitoring Application running on Port TCP9000 on the Enforce Server blocks the correct start of the Service. Is it possible that the IncindentPersister is running on internal Port 9000?

Help!! did somebody have similar problems??

Regards Andy

------------------------------
[Senior System Engineer]
[e3 AG]

[switzerland]
------------------------------

[Stephen Heider]

Hello!

The default port that Enforce communicates on is actually 8100, as per this screenshot:


However, this can be changed to whichever port is required by clicking on the "Configure" button that is part of the above server detail.


In terms of services, there are other ones which are part of default configurations as well - but none of mine specifically seem to land (or loopback) to port 9000.

E.g., 
C:\Program Files\Symantec\DataLossPrevention\EnforceServer\Services\SymantecDLPIncidentPersister.conf

# Java Additional Parameters - jdb debugging
# wrapper.java.additional.101 = -Xdebug
# wrapper.java.additional.102 = -Xrunjdwp:transport=dt_socket,address=5007,server=y,suspend=n

It may be helpful to verify which services or apps are using that TCP port, via netstat or other command, to be sure.



------------------------------
Global Support Lead, DLP
Broadcom, Symantec Enterprise Division
------------------------------

[Huggenberger Andre]

Thank you Stephen Heider
Today I will check this on the Customer site

Regards Andy

------------------------------
[Senior System Engineer]
[e3 AG]

[switzerland]
------------------------------

[Huggenberger Andre]

Here the Evidence in the IncidentPersister_0_Abstract.log. Can I change this place you mentioned" C:\Program Files\Symantec\DataLossPrevention\EnforceServer\Services\SymantecDLPIncidentPersister.conf" . Thank you for your feedback!


Regards Andy

------------------------------
[Senior System Engineer]
[e3 AG]

[switzerland]
------------------------------

[Stephen Heider]

Thanks for confirming that!
I recommend opening a support case, because we would need to review the options as set in a few properties and configuration files.

In some cases, this might be a one-off (loopback address chosen at random which landed on 9000), but that would only be true if a restart allows the Incident Persister to start successfully after the above failure.

Again, our team should be able to investigate via a case!

Warm regards,
Stephen

------------------------------
Global Support Lead, DLP
Broadcom, Symantec Enterprise Division
------------------------------

[Stephen Heider]

Hi Andre.

Did you ever get a case open for this issue?
I just came across an internal defect for what is actually a change in DLP 15.8 - just as you've identified above!

We are going to draft a KB but the quickest way to ensure you've got the issue sorted is to open a ticket with support.

FYI: Tell your support engineer it is tied to defect issue DLP-42200.

Regards,
Stephen

------------------------------
Global Support Lead, DLP
Broadcom, Symantec Enterprise Division
------------------------------

[SBG-APD]

Thanks.  I'll have to revisit but will follow your advice.

 

Steve