1 Reply Latest reply on Mar 16, 2011 8:27 AM by shahids75

    unable to open evidences from dlp monitor

      Hi,

       

      I am not able ot open a single evidence from the DLP Monitor.

      Each time when I try to open evidence it gives me different error messages any of the following

       

      BAD_DATA

      BUFFER_TOO_SMALL

      Decompress Error

      Root element is missing

       

      I can see the evidence file in the evidence folder which i try to open from dlp monitor. BUt its not opening through dlp monitor.

       

      I tried once restating ePO services it worked for me, but after 10-15 mins it again stopped working and started giving errors.

       

      Please help me to resolve this issue.

       

      Regards,

      Prashant Thumar

        • 1. Re: unable to open evidences from dlp monitor
          shahids75

          Hi,

           

          1st.  Did you configured the evidence folder with special permissions ? if not then in IG of HDLP follow the steps.

           

          2nd.  Did you enable evice check box in protection rules ?

           

          If above are Fine and still events not opening, then check the 3rd suggesiton. Try it in some test lab. (I tried it and its work for me).

           

          3rd.  Open ePO Database base in SQL Server.  Goto Tables .   Search DLP password table. View table records.

           

          (if two rows are added then it will give you error wehn you try to open evidence from dlp monitor.

           

          Copy these two entries table rows and   save in some txt file

           

          After copying delete these two entries--> close the table.

           

          Now open hdlp policy click on Tools menu--> option--> security ( enter new password)  Click OK. Apply settings.

           

          Now open again this table and you will see only one entry in table.

           

          Now generate again the event,   --->  send to ePO and check if evidence open or not.

           

           

          Regards

           

          Shahid

           

          Message was edited by: shahids75 on 3/16/11 8:27:40 AM CDT