No New Incidents appear in The Console

[Moustafa Salah]

Hello,
I have an issue that i can't see the Incidents of the Network Prevent for mail in the Console there were many incidents came before and i can see it but it is old incidents and when i use the Policy the new incidents not come and when we restart the enforce server the incidents come, the issue recurs and we can not restart the enforce server every time so any one has an advice with the solution of this problem.
Thanks

[Paul Evans]

Hello Moustafa,

I would review the logs files for DLP up to the time is stops working and see if you can find any errors.  Here is a link to all the logs files and what they go with.

https://knowledge.broadcom.com/external/article/160172/dlp-server-log-files-location-and-descri.html#:~:text=DLP%20provides%20many%20operational%20log,how%20the%20system%20is%20running.&text=server%20and%20the%20agents.&text=This%20file%20is%20typically%20very,to%20that%20particular%20server%20type. 

I hope that helps.

Paul 

.

[Moustafa Salah]

hello paul,
 
the logs that i have doesn't contains any thing useful or errors
unfortunately i still not found a solution for this problem is this problem appeared to you before ?

[Paul Evans]

Turn on detection trace logging under system > server > logs for the detection server under the configuration tab.  Then reproduce and get the logs.  Search through the detection_operational_trace_0.log for the policy and see what the policy does.  Here is a link to the help guide on it.

https://help.symantec.com/cs/dlp15.5/DLP/v33581443_v128674454/Configuring-server-logging-behavior?locale=EN_US 

This helps alot to confirm if an incident is even being created.

Thanks 

      

Paul Evans

.