4 Replies Latest reply on May 8, 2010 5:53 AM by delepo

    Evidence was not replicated on printing rule

      Hi all,

       

      The event monitor doesn't show evidences from a printing rule event, DLP generates the event but in the evidence files section I  get an image of a break link and if I try to open this link I get this message: "Evidence was not replicated". I have other  types of rules (email protection, removable storage) and in this cases the evidence can be showed normally.

       

      With the query "Unsupported printers" I checked that the printers are managed by dlp.

       

      Currently running DLP 3.0 with EPO 4.5

       

      Any ideas?

       

      Thanks.

        • 1. Re: Evidence was not replicated on printing rule

          Did you ever solve this issue, as I'm experiencing the same issue in our deployment.

          • 2. Re: Evidence was not replicated on printing rule

            Hi dmberry,

             

            We still having the problem, we contact Mcafee support and they tell us to upgrade to DLP version 9 but this not resolve the problem.

             

            It´s good to know that we are not the only that have this problem, I'll provide you feedback if we resolve the issue and I would be thankful if you do the same.

            • 3. Re: Evidence was not replicated on printing rule

              Can u confirm the following?

              1. The file used for testing is within the following limits configured under Agent Configuration:

                   a. Evidence Size Limit

                   b. Text Extractor Input / Output Limit

              2. If you are using v9, ensure that all modules for Printing are checked (Global Printing module, Adobe, Word and the other two)?

              Most probably the following have already been done:

              3. Ensure that the test machine or the Evidence$ machines are not running out of space

              4. The test machine is part of a domain and that Domain Computers have been provided permission on the Evidence$ share

              1 of 1 people found this helpful
              • 4. Re: Evidence was not replicated on printing rule

                Hi, finally we resolved the issue with the help of the Mcafee support.

                 

                The problem was that for some users groups we had broken inheritance in the agent configuration and when you upgrade the version you have to stop this broken inheritance, duplicate the default agent configuration and then if you want break the inheritance again.