The event monitor doesn't show evidences from a printing rule event, DLP generates the event but in the evidence files section I get an image of a break link and if I try to open this link I get this message: "Evidence was not replicated". I have other types of rules (email protection, removable storage) and in this cases the evidence can be showed normally.
With the query "Unsupported printers" I checked that the printers are managed by dlp.
Currently running DLP 3.0 with EPO 4.5
We still having the problem, we contact Mcafee support and they tell us to upgrade to DLP version 9 but this not resolve the problem.
It´s good to know that we are not the only that have this problem, I'll provide you feedback if we resolve the issue and I would be thankful if you do the same.
Can u confirm the following?
1. The file used for testing is within the following limits configured under Agent Configuration:
a. Evidence Size Limit
b. Text Extractor Input / Output Limit
2. If you are using v9, ensure that all modules for Printing are checked (Global Printing module, Adobe, Word and the other two)?
Most probably the following have already been done:
3. Ensure that the test machine or the Evidence$ machines are not running out of space
4. The test machine is part of a domain and that Domain Computers have been provided permission on the Evidence$ share
Hi, finally we resolved the issue with the help of the Mcafee support.
The problem was that for some users groups we had broken inheritance in the agent configuration and when you upgrade the version you have to stop this broken inheritance, duplicate the default agent configuration and then if you want break the inheritance again.