3 Replies Latest reply on Feb 3, 2017 12:24 PM by hhoang

    Evidence is not available


      Hi all,

      After 22th of November I have  very strange problem. When I`m trying to open evidence file from DLP Incident Manager an error occurs "Evidence is not available". Before 22th of November I hadn`t had this problem.


      I didn`t change something.

      I recheck evidence folder permission, there was everything ok, but I changed from Special to Full Access for "Everyone" and "Domain Computers"


      I created new evidence folder, but there is not any new files.

      In DLP Incident Management event status is Offline, but agent reach the server.


      I have:

           Windows Server 2008R2

           DLP 9.3.600.5 (I upgraded after problem, before was 9.3.400)

           ePO 5.0



      Do you have any idea?



      Thank you in advance.

        • 1. Re: Evidence is not available

          DLP Agent queries DNS the first listed agent handler in the sitelist to verify connectivity. The DNS lookup must return the IP listed in the sitelist or the DLP Agent will be offline. If a DMZ agent handler is listed first in the sitelist, the Agent Handler configuration will likely have a published IP address of the Public IP but DNS will return the private IP of the server.


          From a client machine, check this registery key to view the sitelist:


          HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Network Associates\ePolicy Orchestrator\Agent | ePOServerList


          Perform a NSLOOKUP and verify the FQDN resolves to the IP address listed for the first listed Agent Handler.

          • 2. Re: Evidence is not available


            I'm currently having this issue, but only for incidents coming from Macintosh systems. I'm able to view evidence files generated by Window systems.

            • 3. Re: Evidence is not available

              What version OSX is the client system?  What version of DLPe is installed on that system?